Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.64454
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2009:1177
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2009:1177.

Python is an interpreted, interactive, object-oriented programming
language.

When the assert() system call was disabled, an input sanitization flaw was
revealed in the Python string object implementation that led to a buffer
overflow. The missing check for negative size values meant the Python
memory allocator could allocate less memory than expected. This could
result in arbitrary code execution with the Python interpreter's
privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode
string processing and in the Python Unicode and string object
implementations. An attacker could use these flaws to cause a denial of
service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If
a Python application used the imageop module to process untrusted images,
it could cause the application to crash or, potentially, execute arbitrary
code with the Python interpreter's privileges. (CVE-2008-1679,
CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python
snprintf() wrapper implementation. An attacker could use these flaws to
cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules. An
attacker could use these flaws to cause a denial of service (Python
application crash). (CVE-2008-2315, CVE-2008-3143)

An integer signedness error, leading to a buffer overflow, was found
in the Python zlib extension module. If a Python application requested
the negative byte count be flushed for a decompression stream, it could
cause the application to crash or, potentially, execute arbitrary code
with the Python interpreter's privileges. (CVE-2008-1721)

Red Hat would like to thank David Remahl of the Apple Product Security team
for responsibly reporting the CVE-2008-1679 and CVE-2008-2315 issues.

All Python users should upgrade to these updated packages, which contain
backported patches to correct these issues.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2009-1177.html
http://www.redhat.com/security/updates/classification/#moderate

CVSS Score:
10.0

CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2008-1679
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
Debian Security Information: DSA-1551 (Google Search)
http://www.debian.org/security/2008/dsa-1551
Debian Security Information: DSA-1620 (Google Search)
http://www.debian.org/security/2008/dsa-1620
http://security.gentoo.org/glsa/glsa-200807-01.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:163
http://www.mandriva.com/security/advisories?name=MDVSA-2008:164
http://bugs.python.org/msg64682
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10583
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7800
http://secunia.com/advisories/29889
http://secunia.com/advisories/29955
http://secunia.com/advisories/30872
http://secunia.com/advisories/31255
http://secunia.com/advisories/31358
http://secunia.com/advisories/31365
http://secunia.com/advisories/31518
http://secunia.com/advisories/31687
http://secunia.com/advisories/33937
http://secunia.com/advisories/38675
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.525289
SuSE Security Announcement: SUSE-SR:2008:017 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
http://www.ubuntu.com/usn/usn-632-1
XForce ISS Database: python-imageopc-bo(41958)
https://exchange.xforce.ibmcloud.com/vulnerabilities/41958
Common Vulnerability Exposure (CVE) ID: CVE-2008-1721
BugTraq ID: 28715
http://www.securityfocus.com/bid/28715
Bugtraq: 20080409 IOActive Security Advisory: Buffer overflow in Python zlib extension module (Google Search)
http://www.securityfocus.com/archive/1/490690/100/0/threaded
Bugtraq: 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components (Google Search)
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.mandriva.com/security/advisories?name=MDVSA-2008:085
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8249
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8494
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9407
http://www.securitytracker.com/id?1019823
http://secunia.com/advisories/37471
http://securityreason.com/securityalert/3802
http://www.vupen.com/english/advisories/2008/1229/references
http://www.vupen.com/english/advisories/2009/3316
XForce ISS Database: zlib-pystringfromstringandsize-bo(41748)
https://exchange.xforce.ibmcloud.com/vulnerabilities/41748
Common Vulnerability Exposure (CVE) ID: CVE-2008-1887
BugTraq ID: 28749
http://www.securityfocus.com/bid/28749
Bugtraq: 20080411 IOActive Security Advisory: Incorrect input validation in PyString_FromStringAndSize() leads to multiple buffer overflows (Google Search)
http://www.securityfocus.com/archive/1/490776
Bugtraq: 20090824 rPSA-2009-0122-1 idle python (Google Search)
http://www.securityfocus.com/archive/1/506056/100/0/threaded
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10407
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8624
XForce ISS Database: python-pystringfromstringandsize-bo(41944)
https://exchange.xforce.ibmcloud.com/vulnerabilities/41944
Common Vulnerability Exposure (CVE) ID: CVE-2008-2315
BugTraq ID: 30491
http://www.securityfocus.com/bid/30491
Debian Security Information: DSA-1667 (Google Search)
http://www.debian.org/security/2008/dsa-1667
http://security.gentoo.org/glsa/glsa-200807-16.xml
http://www.openwall.com/lists/oss-security/2008/11/05/2
http://www.openwall.com/lists/oss-security/2008/11/05/3
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8445
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8683
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9761
http://secunia.com/advisories/31305
http://secunia.com/advisories/31332
http://secunia.com/advisories/32793
http://www.vupen.com/english/advisories/2008/2288
XForce ISS Database: python-modules-bo(44172)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44172
XForce ISS Database: python-multiple-bo(44173)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44173
Common Vulnerability Exposure (CVE) ID: CVE-2008-3142
Bugtraq: 20080813 rPSA-2008-0243-1 idle python (Google Search)
http://www.securityfocus.com/archive/1/495445/100/0/threaded
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11466
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8422
http://secunia.com/advisories/31473
XForce ISS Database: python-unicode-bo(44170)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44170
Common Vulnerability Exposure (CVE) ID: CVE-2008-3143
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7720
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8996
Common Vulnerability Exposure (CVE) ID: CVE-2008-3144
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10170
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7725
XForce ISS Database: python-pyosvsnprintf-bo(44171)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44171
Common Vulnerability Exposure (CVE) ID: CVE-2008-4864
BugTraq ID: 31932
http://www.securityfocus.com/bid/31932
BugTraq ID: 31976
http://www.securityfocus.com/bid/31976
http://scary.beasts.org/security/CESA-2008-008.html
http://www.openwall.com/lists/oss-security/2008/10/27/2
http://www.openwall.com/lists/oss-security/2008/10/29/3
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10702
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8354
XForce ISS Database: python-image-module-bo(46606)
https://exchange.xforce.ibmcloud.com/vulnerabilities/46606
Common Vulnerability Exposure (CVE) ID: CVE-2008-5031
http://security.gentoo.org/glsa/glsa-200907-16.xml
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11280
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8564
http://secunia.com/advisories/35750
XForce ISS Database: python-expandtabs-integer-overflow(46612)
https://exchange.xforce.ibmcloud.com/vulnerabilities/46612
CopyrightCopyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.