CVE-2008-1679 Multiple integer overflows in imageop.c in Python before 2.5.3 allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted images that trigge...
MediumCVSS 6.8
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple integer overflows in imageop.c in Python before 2.5.3 allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows. NOTE: this issue is due to an incomplete fix for CVE-2007-4965.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python | < 2.5.3 | 2.5.3 |
References
- bugs.python.org issue-tracking vendor-advisory
- bugs.python.org issue-tracking vendor-advisory
- APPLE-SA-2009-02-12 mailing-list vendor-advisory
- SUSE-SR:2008:017 third-party-advisory vendor-advisory
- 29889 patch third-party-advisory vendor-advisory
- 29955 broken-link third-party-advisory
- 30872 broken-link third-party-advisory
- 31255 broken-link third-party-advisory
- 31358 broken-link third-party-advisory
- 31365 broken-link third-party-advisory
- 31518 broken-link third-party-advisory
- 31687 broken-link third-party-advisory
- 33937 broken-link third-party-advisory
- 38675 broken-link third-party-advisory
- GLSA-200807-01 third-party-advisory vendor-advisory
- SSA:2008-217-01 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- support.avaya.com third-party-advisory
- wiki.rpath.com third-party-advisory
- DSA-1551 patch third-party-advisory vendor-advisory
- DSA-1620 third-party-advisory vendor-advisory
- MDVSA-2008:163 broken-link third-party-advisory vendor-advisory
- MDVSA-2008:164 broken-link third-party-advisory vendor-advisory
- www.novell.com third-party-advisory
- USN-632-1 third-party-advisory vendor-advisory
- python-imageopc-bo(41958) vdb-entry
- issues.rpath.com third-party-advisory
- oval:org.mitre.oval:def:10583 broken-link signature vdb-entry
- oval:org.mitre.oval:def:7800 broken-link signature vdb-entry