PT-2008-3415 · Python+1 · Python+1

Justin Ferguson · Published 2008-04-18 · Updated 2022-06-27 · CVE-2008-1887

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Python versions 2.5.2 and earlier

Description The issue allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString FromStringAndSize function. This function allocates less memory than expected when assert() is disabled, triggering a buffer overflow.

Recommendations For Python versions 2.5.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2008-1887

DSA-1551-1

DSA-1620-1

PSF-2008-3

RHSA-2009:1176

RHSA-2009:1177

RHSA-2009:1178

RHSA-2009_1176

RHSA-2009_1177

Affected Products

Python

Red Hat

References · 53

• 🔥 http://securityfocus.com/archive/1/490776 · Exploit
• 🔥 http://bugs.python.org/issue2587 · Exploit
• https://osv.dev/vulnerability/PSF-2008-3 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html · Vendor Advisory
• http://securityfocus.com/bid/28749 · Patch
• http://security.gentoo.org/glsa/glsa-200807-01.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html · Vendor Advisory
• http://ubuntu.com/usn/usn-632-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1887 · Security Note
• https://access.redhat.com/security/cve/CVE-2007-2052 · Note
• http://scary.beasts.org/security/CESA-2008-008.html · Note
• http://secunia.com/advisories/31365 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065826.html · Note
• http://secunia.com/advisories/37471 · Note
• http://debian.org/security/2008/dsa-1551 · Patch, Vendor Advisory