CVSS: 9.1EPSS: 1%CPEs: 9EXPL: 0CVE-2012-2135
https://notcve.org/view.php?id=CVE-2012-2135
14 Aug 2012 — The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors. El descodificador UTF-16 en Python v3.1 a v3.3 no actualiza la variable aligned_end después de llamar a la función unicode_decode_call_errorhandler, lo que permite a atacantes remotos obtener informació... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670389 •
CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 0CVE-2012-0876 – expat: hash table collisions CPU usage DoS
https://notcve.org/view.php?id=CVE-2012-0876
03 Jul 2012 — The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value. El analizador XML (xmlparse.c) en expat antes de v2.1.0 calcula los valores de hash sin restringir la capacidad de desencadenar colisiones hash de forma predecible, lo que permite causar una denegación de servicio (por con... • http://bugs.python.org/issue13703#msg151870 • CWE-400: Uncontrolled Resource Consumption CWE-407: Inefficient Algorithmic Complexity •
CVSS: 6.1EPSS: 1%CPEs: 39EXPL: 0CVE-2011-4940 – python: potential XSS in SimpleHTTPServer's list_directory()
https://notcve.org/view.php?id=CVE-2011-4940
27 Jun 2012 — The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding. La función list_directory en lib/SimpleHTTPServer.py en SimpleHTTPServer en Python anterior a v2.5.6c1, v2.6.x anterior a v2.6.7 RC2, y v2.7.x anterior a v2.7.... • http://bugs.python.org/issue11442 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.4EPSS: 2%CPEs: 39EXPL: 0CVE-2011-1521 – urllib2): Improper management of ftp:// and file:// URL schemes (Issue #11662)
https://notcve.org/view.php?id=CVE-2011-1521
24 May 2011 — The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs. Los módulos urllib y urllib2 en Python v2.x anteriores a v2.7.2 y v3.x anteriores a v3.2.1 procesan los encabezados de ubicación que especificar la redir... • http://bugs.python.org/issue11662 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2010-3492 – Gentoo Linux Security Advisory 201401-04
https://notcve.org/view.php?id=CVE-2010-3492
19 Oct 2010 — The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections. El módulo asyncore en Python anterior a v3.2 no controla correctamente llamadas fallidas a la función accept, y no tiene la doc... • http://bugs.python.org/issue6706 •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2009-4134 – python: rgbimg: multiple security issues
https://notcve.org/view.php?id=CVE-2009-4134
27 May 2010 — Buffer underflow in the rgbimg module in Python 2.5 allows remote attackers to cause a denial of service (application crash) via a large ZSIZE value in a black-and-white (aka B/W) RGB image that triggers an invalid pointer dereference. Desbordamiento inferior de búfer en el módulo rgbimg en Python v2.5 permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través de un valor ZSIZE grande en una imagen RGB blanco-y-negro (también conocido como B/W) que lanza una desreferencia... • http://bugs.python.org/issue8678 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0CVE-2010-1449 – python: rgbimg: multiple security issues
https://notcve.org/view.php?id=CVE-2010-1449
27 May 2010 — Integer overflow in rgbimgmodule.c in the rgbimg module in Python 2.5 allows remote attackers to have an unspecified impact via a large image that triggers a buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-3143.12. Desbordamiento de entero en rgbimgmodule.c en el módulo rgbimg en Python v2.5 permite a atacantes remotos tener un impacto sin especificar a través de fichero de imagen grande que provoca un desbordamiento de búfer. NOTA: esta vulnerabilidad existe debid... • http://bugs.python.org/issue8678 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2010-1450 – python: rgbimg: multiple security issues
https://notcve.org/view.php?id=CVE-2010-1450
27 May 2010 — Multiple buffer overflows in the RLE decoder in the rgbimg module in Python 2.5 allow remote attackers to have an unspecified impact via an image file containing crafted data that triggers improper processing within the (1) longimagedata or (2) expandrow function. Múltiples desbordamientos de búfer en el decodificador RLE en el módulo rgbimg en Python v2.5 permite a atacantes remotos tener un impacto sin especificar a través de fichero de imagen que contiene datos manipulados que lanza un procesado inapropi... • http://bugs.python.org/issue8678 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 1%CPEs: 13EXPL: 0CVE-2010-1634 – python: audioop: incorrect integer overflow checks
https://notcve.org/view.php?id=CVE-2010-1634
27 May 2010 — Multiple integer overflows in audioop.c in the audioop module in Python 2.6, 2.7, 3.1, and 3.2 allow context-dependent attackers to cause a denial of service (application crash) via a large fragment, as demonstrated by a call to audioop.lin2lin with a long string in the first argument, leading to a buffer overflow. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3143.5. Múltiples desbordamientos de entero en audioop.c en el módulo audioop en Python v2.6, v2.7, v3.1 y v3.2, permite a... • http://bugs.python.org/issue8674 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 17%CPEs: 3EXPL: 1CVE-2010-2089 – Python 3.2 - 'audioop' Module Memory Corruption
https://notcve.org/view.php?id=CVE-2010-2089
27 May 2010 — The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-dependent attackers to cause a denial of service (memory corruption and application crash) via crafted arguments, as demonstrated by a call to audioop.reverse with a one-byte string, a different vulnerability than CVE-2010-1634. El módulo audioop en Python v2.7 y v3.2 no verifica las relaciones entre tamaños de argumentos y longitud de cadenas de byte, lo que permit... • https://www.exploit-db.com/exploits/34145 • CWE-787: Out-of-bounds Write •