PT-2010-3297 · Python+1 · Python+1

Tomas Hoger · Published 2010-05-27 · Updated 2023-02-13 · CVE-2010-1634

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Python versions 2.6 through 3.2

Description The issue is caused by multiple integer overflows in the audioop module, specifically in the audioop.c file. This allows context-dependent attackers to cause a denial of service, resulting in an application crash, by providing a large fragment. For example, calling audioop.lin2lin with a long string in the first argument can lead to a buffer overflow. This vulnerability exists due to an incorrect fix for a previous issue.

Recommendations For Python versions 2.6 through 3.2, consider applying a patch or fix to address the integer overflows in the audioop module. As a temporary workaround, restrict the use of the audioop.lin2lin function with large input strings to minimize the risk of a denial of service.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2010-1634

PSF-2010-4

RHSA-2011:0027

RHSA-2011:0491

RHSA-2011_0027

RHSA-2011_0491

Affected Products

Python

Red Hat

References · 51

• http://bugs.python.org/issue8674 · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=590690 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1634 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1613-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-1634 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042751.html · Vendor Advisory
• http://svn.python.org/view?rev=81079&view=rev · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-1634 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1616-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-1596-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09649 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-1634 · Security Note