PT-2008-3415 · Python+1 · Python+1

Justin Ferguson · Publicado 2008-04-18 · Atualizado 2022-06-27 · CVE-2008-1887

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Python versions 2.5.2 and earlier

Description The issue allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString FromStringAndSize function. This function allocates less memory than expected when assert() is disabled, triggering a buffer overflow.

Recommendations For Python versions 2.5.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

CVE-2008-1887

DSA-1551-1

DSA-1620-1

PSF-2008-3

RHSA-2009:1176

RHSA-2009:1177

RHSA-2009:1178

RHSA-2009_1176

RHSA-2009_1177

Produtos afetados

Python

Red Hat

Referências · 53

• 🔥 http://securityfocus.com/archive/1/490776 · Exploit
• 🔥 http://bugs.python.org/issue2587 · Exploit
• https://access.redhat.com/security/cve/CVE-2007-2052 · Nota
• http://scary.beasts.org/security/CESA-2008-008.html · Nota
• https://osv.dev/vulnerability/PSF-2008-3 · Aviso do Fabricante
• http://secunia.com/advisories/31365 · Nota
• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html · Aviso do Fabricante
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065826.html · Nota
• http://securityfocus.com/bid/28749 · Correção
• http://secunia.com/advisories/37471 · Nota
• http://debian.org/security/2008/dsa-1551 · Correção, Aviso do Fabricante
• http://novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5032900 · Nota
• http://securityreason.com/securityalert/3802 · Nota
• https://access.redhat.com/security/cve/CVE-2008-3142 · Nota
• https://access.redhat.com/security/cve/CVE-2008-3143 · Nota