9.3

CVE-2008-1887

Exploit
Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString_FromStringAndSize function, which allocates less memory than expected when assert() is disabled and triggers a buffer overflow.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Python ≫ Python Version <= 2.5.2
Canonical ≫ Ubuntu Linux Version6.06
Canonical ≫ Ubuntu Linux Version7.04
Canonical ≫ Ubuntu Linux Version7.10
Canonical ≫ Ubuntu Linux Version8.04 SwEdition-
Debian ≫ Debian Linux Version4.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 6.29% 0.927
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
Third Party Advisory
Mailing List
http://secunia.com/advisories/33937
Not Applicable
http://support.apple.com/kb/HT3438
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
Third Party Advisory
Mailing List
http://secunia.com/advisories/31687
Not Applicable
http://secunia.com/advisories/29889
Not Applicable
http://secunia.com/advisories/31255
Not Applicable
http://secunia.com/advisories/37471
Not Applicable
http://www.debian.org/security/2008/dsa-1551
Patch
Third Party Advisory
http://www.debian.org/security/2008/dsa-1620
Patch
Third Party Advisory
http://www.securityfocus.com/archive/1/507985/100/0/threaded
Third Party Advisory
VDB Entry
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
Third Party Advisory
http://www.vupen.com/english/advisories/2009/3316
Permissions Required
http://secunia.com/advisories/30872
Not Applicable
http://secunia.com/advisories/31365
Not Applicable
http://security.gentoo.org/glsa/glsa-200807-01.xml
Third Party Advisory
http://www.ubuntu.com/usn/usn-632-1
Third Party Advisory
http://bugs.python.org/issue2587
Vendor Advisory
Exploit
Issue Tracking
http://secunia.com/advisories/31518
Not Applicable
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0122
Broken Link
http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5032900
Third Party Advisory
http://www.securityfocus.com/archive/1/490776
Third Party Advisory
Exploit
VDB Entry
http://www.securityfocus.com/archive/1/506056/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/28749
Patch
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/41944
Third Party Advisory
VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10407
Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8624
Third Party Advisory