CVE-2008-3144 Multiple integer overflows in the PyOS_vsnprintf function in Python/mysnprintf.c in Python 2.5.2 and earlier allow context-dependent attackers to cause a denial of service (memory corruption) or have....
MediumCVSS 5.0
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple integer overflows in the PyOS_vsnprintf function in Python/mysnprintf.c in Python 2.5.2 and earlier allow context-dependent attackers to cause a denial of service (memory corruption) or have unspecified other impact via crafted input to string formatting operations. NOTE: the handling of certain integer values is also affected by related integer underflows and an off-by-one error.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python | <= 2.5.2 | No fix listed |
References
- bugs.gentoo.org third-party-advisory
- bugs.python.org exploit
- bugs.python.org issue-tracking vendor-advisory
- APPLE-SA-2009-02-12 mailing-list vendor-advisory
- SUSE-SR:2008:017 third-party-advisory vendor-advisory
- 31305 broken-link third-party-advisory
- 31332 broken-link third-party-advisory
- 31358 broken-link third-party-advisory
- 31365 broken-link third-party-advisory
- 31473 broken-link third-party-advisory
- 31518 broken-link third-party-advisory
- 31687 broken-link third-party-advisory
- 32793 broken-link third-party-advisory
- 33937 broken-link third-party-advisory
- 37471 broken-link third-party-advisory
- GLSA-200807-16 third-party-advisory vendor-advisory
- SSA:2008-217-01 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- svn.python.org issue-tracking vendor-advisory
- svn.python.org issue-tracking vendor-advisory
- svn.python.org issue-tracking vendor-advisory
- wiki.rpath.com third-party-advisory
- DSA-1667 third-party-advisory vendor-advisory
- MDVSA-2008:163 broken-link third-party-advisory vendor-advisory
- MDVSA-2008:164 broken-link third-party-advisory vendor-advisory
- www.novell.com third-party-advisory
- 20080813 rPSA-2008-0243-1 idle python mailing-list third-party-advisory vdb-entry
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list third-party-advisory vdb-entry
- 30491 third-party-advisory vdb-entry
- USN-632-1 third-party-advisory vendor-advisory
- www.vmware.com third-party-advisory
- ADV-2008-2288 broken-link third-party-advisory vdb-entry
- ADV-2009-3316 broken-link third-party-advisory vdb-entry
- python-pyosvsnprintf-bo(44171) vdb-entry
- python-multiple-bo(44173) vdb-entry
- oval:org.mitre.oval:def:10170 broken-link signature vdb-entry
- oval:org.mitre.oval:def:7725 broken-link signature vdb-entry