CVE-2008-1887 Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString_FromStringAndSize function, w...
HighCVSS 9.3
EPSS 6.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString_FromStringAndSize function, which allocates less memory than expected when assert() is disabled and triggers a buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python | <= 2.5.2 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 7.04 | No fix listed |
| Canonical Ubuntu Linux | = 7.10 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| debian linux | = 4.0 | No fix listed |
References
- bugs.python.org exploit issue-tracking vendor-advisory
- APPLE-SA-2009-02-12 mailing-list third-party-advisory vendor-advisory
- SUSE-SR:2008:017 mailing-list third-party-advisory vendor-advisory
- 29889 not-applicable third-party-advisory
- 30872 not-applicable third-party-advisory
- 31255 not-applicable third-party-advisory
- 31365 not-applicable third-party-advisory
- 31518 not-applicable third-party-advisory
- 31687 not-applicable third-party-advisory
- 33937 not-applicable third-party-advisory
- 37471 not-applicable third-party-advisory
- GLSA-200807-01 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- wiki.rpath.com broken-link
- DSA-1551 patch third-party-advisory vendor-advisory
- DSA-1620 patch third-party-advisory vendor-advisory
- www.novell.com third-party-advisory
- 20080411 IOActive Security Advisory: Incorrect input validation in PyString_FromStringAndSize() leads to multiple buffer overflows exploit mailing-list third-party-advisory vdb-entry
- 20090824 rPSA-2009-0122-1 idle python mailing-list third-party-advisory vdb-entry
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list third-party-advisory vdb-entry
- 28749 patch third-party-advisory vdb-entry
- USN-632-1 third-party-advisory vendor-advisory
- www.vmware.com third-party-advisory
- ADV-2009-3316 permissions-required vdb-entry
- python-pystringfromstringandsize-bo(41944) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:10407 signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:8624 signature third-party-advisory vdb-entry