CVSS: 7.5EPSS: 1%CPEs: 58EXPL: 1CVE-2012-1150 – python: hash table collisions CPU usage DoS (oCERT-2011-003)
https://notcve.org/view.php?id=CVE-2012-1150
05 Oct 2012 — Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. Python anteriores a v2.6.8, v2.7.x anteriores a v2.7.3, 3.x anteriores a v3.1.5, y v3.2.x anteriores a v3.2.3 procesa los valores hash sin restringir la disponibilidad para provocar co... • http://bugs.python.org/issue13703 • CWE-310: Cryptographic Issues •
CVSS: 7.4EPSS: 0%CPEs: 28EXPL: 0CVE-2011-4944 – python: distutils creates ~/.pypirc insecurely
https://notcve.org/view.php?id=CVE-2011-4944
27 Aug 2012 — Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file. Python v2.6 a través de 3.2 crea ~/.pypirc con permisos de lectura en todo el mundo antes de cambiar los datos que se han escrito, introduce una condición de carrera que permite a usuarios locales obtener un nombre de usuario y contraseña mediante la lectura de este archivo. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=650555 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 1%CPEs: 9EXPL: 0CVE-2012-2135
https://notcve.org/view.php?id=CVE-2012-2135
14 Aug 2012 — The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors. El descodificador UTF-16 en Python v3.1 a v3.3 no actualiza la variable aligned_end después de llamar a la función unicode_decode_call_errorhandler, lo que permite a atacantes remotos obtener informació... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670389 •
CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 0CVE-2012-0876 – expat: hash table collisions CPU usage DoS
https://notcve.org/view.php?id=CVE-2012-0876
03 Jul 2012 — The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value. El analizador XML (xmlparse.c) en expat antes de v2.1.0 calcula los valores de hash sin restringir la capacidad de desencadenar colisiones hash de forma predecible, lo que permite causar una denegación de servicio (por con... • http://bugs.python.org/issue13703#msg151870 • CWE-400: Uncontrolled Resource Consumption CWE-407: Inefficient Algorithmic Complexity •
CVSS: 6.1EPSS: 1%CPEs: 39EXPL: 0CVE-2011-4940 – python: potential XSS in SimpleHTTPServer's list_directory()
https://notcve.org/view.php?id=CVE-2011-4940
27 Jun 2012 — The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding. La función list_directory en lib/SimpleHTTPServer.py en SimpleHTTPServer en Python anterior a v2.5.6c1, v2.6.x anterior a v2.6.7 RC2, y v2.7.x anterior a v2.7.... • http://bugs.python.org/issue11442 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.4EPSS: 2%CPEs: 39EXPL: 0CVE-2011-1521 – urllib2): Improper management of ftp:// and file:// URL schemes (Issue #11662)
https://notcve.org/view.php?id=CVE-2011-1521
24 May 2011 — The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs. Los módulos urllib y urllib2 en Python v2.x anteriores a v2.7.2 y v3.x anteriores a v3.2.1 procesan los encabezados de ubicación que especificar la redir... • http://bugs.python.org/issue11662 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2010-3492 – Gentoo Linux Security Advisory 201401-04
https://notcve.org/view.php?id=CVE-2010-3492
19 Oct 2010 — The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections. El módulo asyncore en Python anterior a v3.2 no controla correctamente llamadas fallidas a la función accept, y no tiene la doc... • http://bugs.python.org/issue6706 •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2009-4134 – python: rgbimg: multiple security issues
https://notcve.org/view.php?id=CVE-2009-4134
27 May 2010 — Buffer underflow in the rgbimg module in Python 2.5 allows remote attackers to cause a denial of service (application crash) via a large ZSIZE value in a black-and-white (aka B/W) RGB image that triggers an invalid pointer dereference. Desbordamiento inferior de búfer en el módulo rgbimg en Python v2.5 permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través de un valor ZSIZE grande en una imagen RGB blanco-y-negro (también conocido como B/W) que lanza una desreferencia... • http://bugs.python.org/issue8678 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0CVE-2010-1449 – python: rgbimg: multiple security issues
https://notcve.org/view.php?id=CVE-2010-1449
27 May 2010 — Integer overflow in rgbimgmodule.c in the rgbimg module in Python 2.5 allows remote attackers to have an unspecified impact via a large image that triggers a buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-3143.12. Desbordamiento de entero en rgbimgmodule.c en el módulo rgbimg en Python v2.5 permite a atacantes remotos tener un impacto sin especificar a través de fichero de imagen grande que provoca un desbordamiento de búfer. NOTA: esta vulnerabilidad existe debid... • http://bugs.python.org/issue8678 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2010-1450 – python: rgbimg: multiple security issues
https://notcve.org/view.php?id=CVE-2010-1450
27 May 2010 — Multiple buffer overflows in the RLE decoder in the rgbimg module in Python 2.5 allow remote attackers to have an unspecified impact via an image file containing crafted data that triggers improper processing within the (1) longimagedata or (2) expandrow function. Múltiples desbordamientos de búfer en el decodificador RLE en el módulo rgbimg en Python v2.5 permite a atacantes remotos tener un impacto sin especificar a través de fichero de imagen que contiene datos manipulados que lanza un procesado inapropi... • http://bugs.python.org/issue8678 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •