CVE-2014-7185 Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.
MediumCVSS 6.4
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/python2.7(Debian:11) | < 2.7.8-1 | 2.7.8-1 |
| python | <= 2.7.7 | No fix listed |
| python | = 2.7.1 | No fix listed |
| python | = 2.7.1-rc1 | No fix listed |
| python | = 2.7.2-rc1 | No fix listed |
| python | = 2.7.3 | No fix listed |
| python | = 2.7.4 | No fix listed |
| python | = 2.7.5 | No fix listed |
| python | = 2.7.6 | No fix listed |
| python | = 2.7.1150 | No fix listed |
| python | = 2.7.2150 | No fix listed |
| apple mac os x | <= 10.10.4 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- bugs.python.org exploit
- APPLE-SA-2015-08-13-2 vendor-advisory
- FEDORA-2014-11559 vendor-advisory
- openSUSE-SU-2014:1292 vendor-advisory
- RHSA-2015:1064 vendor-advisory
- RHSA-2015:1330 vendor-advisory
- [oss-security] 20140923 CVE Request: Python 2.7 exploit mailing-list
- [oss-security] 20140925 Re: CVE Request: Python 2.7 mailing-list
- www.oracle.com
- www.oracle.com
- 70089 vdb-entry
- bugzilla.redhat.com exploit
- python-bufferobject-overflow(96193) vdb-entry
- GLSA-201503-10 vendor-advisory
- support.apple.com vendor-advisory