CVSS: 9.8EPSS: 1%CPEs: 12EXPL: 3CVE-2014-7185 – python: buffer() integer overflow leading to out of bounds read
https://notcve.org/view.php?id=CVE-2014-7185
08 Oct 2014 — Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function. Desbordamiento de enteros en bufferobject.c en Python anterior a 2.7.8 permite a atacantes dependientes de contexto obtener información sensible de la memoria de procesos a través de un tamaño y desplazamiento grande en una función 'buffer'. An integer overflow flaw was found in the way the buffer() function handl... • http://bugs.python.org/issue21831 • CWE-189: Numeric Errors CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 6%CPEs: 58EXPL: 1CVE-2012-0845 – python: SimpleXMLRPCServer CPU usage DoS via malformed XML-RPC request
https://notcve.org/view.php?id=CVE-2012-0845
05 Oct 2012 — SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header. SimpleXMLRPCServer.py en SimpleXMLRPCServer en Python antes de v2.6.8, v2.7.x antes de v2.7.3, v3.x antes de v3.1.5, y v3.2.x antes de v3.2.x, permite a atacantes remotos provocar un... • http://bugs.python.org/issue14001 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 1%CPEs: 58EXPL: 1CVE-2012-1150 – python: hash table collisions CPU usage DoS (oCERT-2011-003)
https://notcve.org/view.php?id=CVE-2012-1150
05 Oct 2012 — Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. Python anteriores a v2.6.8, v2.7.x anteriores a v2.7.3, 3.x anteriores a v3.1.5, y v3.2.x anteriores a v3.2.3 procesa los valores hash sin restringir la disponibilidad para provocar co... • http://bugs.python.org/issue13703 • CWE-310: Cryptographic Issues •
CVSS: 6.1EPSS: 1%CPEs: 39EXPL: 0CVE-2011-4940 – python: potential XSS in SimpleHTTPServer's list_directory()
https://notcve.org/view.php?id=CVE-2011-4940
27 Jun 2012 — The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding. La función list_directory en lib/SimpleHTTPServer.py en SimpleHTTPServer en Python anterior a v2.5.6c1, v2.6.x anterior a v2.6.7 RC2, y v2.7.x anterior a v2.7.... • http://bugs.python.org/issue11442 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2010-3492 – Gentoo Linux Security Advisory 201401-04
https://notcve.org/view.php?id=CVE-2010-3492
19 Oct 2010 — The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections. El módulo asyncore en Python anterior a v3.2 no controla correctamente llamadas fallidas a la función accept, y no tiene la doc... • http://bugs.python.org/issue6706 •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2008-5983 – python: untrusted python modules search path
https://notcve.org/view.php?id=CVE-2008-5983
28 Jan 2009 — Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory. Una vulnerabilidad de ruta de búsqueda no confiable en la función API PySys_SetArgv en Python versión 2.6 y anteriores, y posiblemente versiones posteriores, antepone ... • http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042751.html • CWE-426: Untrusted Search Path •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2008-2315 – python: Multiple integer overflows in python core
https://notcve.org/view.php?id=CVE-2008-2315
01 Aug 2008 — Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the (1) stringobject, (2) unicodeobject, (3) bufferobject, (4) longobject, (5) tupleobject, (6) stropmodule, (7) gcmodule, and (8) mmapmodule modules. NOTE: The expandtabs integer overflows in stringobject and unicodeobject in 2.5.2 are covered by CVE-2008-5031. Múltiples desbordamientos de enteros en Python 2.5.2 y anteriores. Permite a atacantes dependientes de contexto... • http://bugs.gentoo.org/attachment.cgi?id=159418&action=view • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2008-2316
https://notcve.org/view.php?id=CVE-2008-2316
01 Aug 2008 — Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB." Desbordamiento de entero en _hashopenssl.c en el módulo hashlib en Python 2.5.2 y anteriores. Podría permitir a atacantes dependientes del contexto vencer resúmenes criptográficos, relativos a "comprobación parcial hashlib de datos que exceden de 4GB." • http://bugs.gentoo.org/attachment.cgi?id=159422&action=view • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 1CVE-2008-3142 – python: Multiple buffer overflows in unicode processing
https://notcve.org/view.php?id=CVE-2008-3142
01 Aug 2008 — Multiple buffer overflows in Python 2.5.2 and earlier on 32bit platforms allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a long string that leads to incorrect memory allocation during Unicode string processing, related to the unicode_resize function and the PyMem_RESIZE macro. Múltiples desbordamientos de búfer en Python 2.5.2 y anteriores en plataformas de 32bit. Permite a atacantes dependientes de contexto causar denegación de servicio (crash) o ... • http://bugs.gentoo.org/show_bug.cgi?id=232137 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2008-3143 – python: Multiple integer overflows discovered by Google
https://notcve.org/view.php?id=CVE-2008-3143
01 Aug 2008 — Multiple integer overflows in Python before 2.5.2 might allow context-dependent attackers to have an unknown impact via vectors related to (1) Include/pymem.h; (2) _csv.c, (3) _struct.c, (4) arraymodule.c, (5) audioop.c, (6) binascii.c, (7) cPickle.c, (8) cStringIO.c, (9) cjkcodecs/multibytecodec.c, (10) datetimemodule.c, (11) md5.c, (12) rgbimgmodule.c, and (13) stropmodule.c in Modules/; (14) bufferobject.c, (15) listobject.c, and (16) obmalloc.c in Objects/; (17) Parser/node.c; and (18) asdl.c, (19) ast.... • http://bugs.gentoo.org/show_bug.cgi?id=232137 • CWE-190: Integer Overflow or Wraparound •