Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.64453
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2009:1176
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2009:1176.

Python is an interpreted, interactive, object-oriented programming
language.

When the assert() system call was disabled, an input sanitization flaw was
revealed in the Python string object implementation that led to a buffer
overflow. The missing check for negative size values meant the Python
memory allocator could allocate less memory than expected. This could
result in arbitrary code execution with the Python interpreter's
privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode
string processing and in the Python Unicode and string object
implementations. An attacker could use these flaws to cause a denial of
service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If
a Python application used the imageop module to process untrusted images,
it could cause the application to disclose sensitive information, crash or,
potentially, execute arbitrary code with the Python interpreter's
privileges. (CVE-2007-4965, CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python
snprintf() wrapper implementation. An attacker could use these flaws to
cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules. An
attacker could use these flaws to cause a denial of service (Python
application crash). (CVE-2008-2315, CVE-2008-3143)

An integer signedness error, leading to a buffer overflow, was found
in the Python zlib extension module. If a Python application requested
the negative byte count be flushed for a decompression stream, it could
cause the application to crash or, potentially, execute arbitrary code
with the Python interpreter's privileges. (CVE-2008-1721)

A flaw was discovered in the strxfrm() function of the Python locale
module. Strings generated by this function were not properly
NULL-terminated, which could possibly cause disclosure of data stored in
the memory of a Python application using this function. (CVE-2007-2052)

Red Hat would like to thank David Remahl of the Apple Product Security team
for responsibly reporting the CVE-2008-2315 issue.

All Python users should upgrade to these updated packages, which contain
backported patches to correct these issues.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2009-1176.html
http://www.redhat.com/security/updates/classification/#moderate

CVSS Score:
10.0

CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2007-2052
BugTraq ID: 23887
http://www.securityfocus.com/bid/23887
Bugtraq: 20070521 FLEA-2007-0019-1: python (Google Search)
http://www.securityfocus.com/archive/1/469294/30/6450/threaded
Bugtraq: 20080221 VMSA-2008-0003 Moderate: Updated aacraid driver and samba and python service console updates (Google Search)
http://www.securityfocus.com/archive/1/488457/100/0/threaded
Bugtraq: 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components (Google Search)
http://www.securityfocus.com/archive/1/507985/100/0/threaded
Debian Security Information: DSA-1551 (Google Search)
http://www.debian.org/security/2008/dsa-1551
Debian Security Information: DSA-1620 (Google Search)
http://www.debian.org/security/2008/dsa-1620
http://www.mandriva.com/security/advisories?name=MDKSA-2007:099
http://lists.vmware.com/pipermail/security-announce/2008/000005.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11716
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8353
http://www.redhat.com/support/errata/RHSA-2007-1076.html
http://www.redhat.com/support/errata/RHSA-2007-1077.html
http://www.redhat.com/support/errata/RHSA-2008-0629.html
http://secunia.com/advisories/25190
http://secunia.com/advisories/25217
http://secunia.com/advisories/25233
http://secunia.com/advisories/25353
http://secunia.com/advisories/25787
http://secunia.com/advisories/28027
http://secunia.com/advisories/28050
http://secunia.com/advisories/29032
http://secunia.com/advisories/29303
http://secunia.com/advisories/29889
http://secunia.com/advisories/31255
http://secunia.com/advisories/31492
http://secunia.com/advisories/37471
SuSE Security Announcement: SUSE-SR:2007:013 (Google Search)
http://www.novell.com/linux/security/advisories/2007_13_sr.html
http://www.trustix.org/errata/2007/0019/
http://www.ubuntu.com/usn/usn-585-1
http://www.vupen.com/english/advisories/2007/1465
http://www.vupen.com/english/advisories/2008/0637
http://www.vupen.com/english/advisories/2009/3316
XForce ISS Database: python-localemodule-information-disclosure(34060)
https://exchange.xforce.ibmcloud.com/vulnerabilities/34060
Common Vulnerability Exposure (CVE) ID: CVE-2007-4965
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
BugTraq ID: 25696
http://www.securityfocus.com/bid/25696
Bugtraq: 20080212 FLEA-2008-0002-1 python (Google Search)
http://www.securityfocus.com/archive/1/487990/100/0/threaded
Cert/CC Advisory: TA07-352A
http://www.us-cert.gov/cas/techalerts/TA07-352A.html
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00378.html
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065826.html
http://www.gentoo.org/security/en/glsa/glsa-200711-07.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:012
http://www.mandriva.com/security/advisories?name=MDVSA-2008:013
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10804
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8486
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8496
http://secunia.com/advisories/26837
http://secunia.com/advisories/27460
http://secunia.com/advisories/27562
http://secunia.com/advisories/27872
http://secunia.com/advisories/28136
http://secunia.com/advisories/28480
http://secunia.com/advisories/28838
http://secunia.com/advisories/33937
http://secunia.com/advisories/38675
SuSE Security Announcement: SUSE-SR:2008:003 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
http://www.vupen.com/english/advisories/2007/3201
http://www.vupen.com/english/advisories/2007/4238
XForce ISS Database: python-imageop-bo(36653)
https://exchange.xforce.ibmcloud.com/vulnerabilities/36653
Common Vulnerability Exposure (CVE) ID: CVE-2008-1721
BugTraq ID: 28715
http://www.securityfocus.com/bid/28715
Bugtraq: 20080409 IOActive Security Advisory: Buffer overflow in Python zlib extension module (Google Search)
http://www.securityfocus.com/archive/1/490690/100/0/threaded
http://security.gentoo.org/glsa/glsa-200807-01.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:085
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8249
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8494
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9407
http://www.securitytracker.com/id?1019823
http://secunia.com/advisories/29955
http://secunia.com/advisories/30872
http://secunia.com/advisories/31358
http://secunia.com/advisories/31365
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.525289
http://securityreason.com/securityalert/3802
http://www.ubuntu.com/usn/usn-632-1
http://www.vupen.com/english/advisories/2008/1229/references
XForce ISS Database: zlib-pystringfromstringandsize-bo(41748)
https://exchange.xforce.ibmcloud.com/vulnerabilities/41748
Common Vulnerability Exposure (CVE) ID: CVE-2008-1887
BugTraq ID: 28749
http://www.securityfocus.com/bid/28749
Bugtraq: 20080411 IOActive Security Advisory: Incorrect input validation in PyString_FromStringAndSize() leads to multiple buffer overflows (Google Search)
http://www.securityfocus.com/archive/1/490776
Bugtraq: 20090824 rPSA-2009-0122-1 idle python (Google Search)
http://www.securityfocus.com/archive/1/506056/100/0/threaded
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10407
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8624
http://secunia.com/advisories/31518
http://secunia.com/advisories/31687
SuSE Security Announcement: SUSE-SR:2008:017 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
XForce ISS Database: python-pystringfromstringandsize-bo(41944)
https://exchange.xforce.ibmcloud.com/vulnerabilities/41944
Common Vulnerability Exposure (CVE) ID: CVE-2008-2315
BugTraq ID: 30491
http://www.securityfocus.com/bid/30491
Debian Security Information: DSA-1667 (Google Search)
http://www.debian.org/security/2008/dsa-1667
http://security.gentoo.org/glsa/glsa-200807-16.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:163
http://www.mandriva.com/security/advisories?name=MDVSA-2008:164
http://www.openwall.com/lists/oss-security/2008/11/05/2
http://www.openwall.com/lists/oss-security/2008/11/05/3
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8445
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8683
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9761
http://secunia.com/advisories/31305
http://secunia.com/advisories/31332
http://secunia.com/advisories/32793
http://www.vupen.com/english/advisories/2008/2288
XForce ISS Database: python-modules-bo(44172)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44172
XForce ISS Database: python-multiple-bo(44173)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44173
Common Vulnerability Exposure (CVE) ID: CVE-2008-3142
Bugtraq: 20080813 rPSA-2008-0243-1 idle python (Google Search)
http://www.securityfocus.com/archive/1/495445/100/0/threaded
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11466
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8422
http://secunia.com/advisories/31473
XForce ISS Database: python-unicode-bo(44170)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44170
Common Vulnerability Exposure (CVE) ID: CVE-2008-3143
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7720
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8996
Common Vulnerability Exposure (CVE) ID: CVE-2008-3144
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10170
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7725
XForce ISS Database: python-pyosvsnprintf-bo(44171)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44171
Common Vulnerability Exposure (CVE) ID: CVE-2008-4864
BugTraq ID: 31932
http://www.securityfocus.com/bid/31932
BugTraq ID: 31976
http://www.securityfocus.com/bid/31976
http://scary.beasts.org/security/CESA-2008-008.html
http://www.openwall.com/lists/oss-security/2008/10/27/2
http://www.openwall.com/lists/oss-security/2008/10/29/3
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10702
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8354
XForce ISS Database: python-image-module-bo(46606)
https://exchange.xforce.ibmcloud.com/vulnerabilities/46606
Common Vulnerability Exposure (CVE) ID: CVE-2008-5031
http://security.gentoo.org/glsa/glsa-200907-16.xml
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11280
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8564
http://secunia.com/advisories/35750
XForce ISS Database: python-expandtabs-integer-overflow(46612)
https://exchange.xforce.ibmcloud.com/vulnerabilities/46612
CopyrightCopyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.