// For flags

CVE-2008-1721

Python zlib Module - Remote Buffer Overflow

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and a buffer overflow.

Error de signo en entero en el módulo de extensión zlib en Python 2.5.2 y anteriores, permite a atacantes remotos ejecutar código de su elección a través de un entero negativo, lo que provoca una asignación insuficiente de memoria y un desbordamiento de búfer.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-04-09 First Exploit
  • 2008-04-10 CVE Reserved
  • 2008-04-10 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-681: Incorrect Conversion between Numeric Types
CAPEC
References (33)
URL Tag Source
http://secunia.com/advisories/29889 Not Applicable
http://secunia.com/advisories/29955 Not Applicable
http://secunia.com/advisories/30872 Not Applicable
http://secunia.com/advisories/31255 Not Applicable
http://secunia.com/advisories/31358 Not Applicable
http://secunia.com/advisories/31365 Not Applicable
http://secunia.com/advisories/33937 Not Applicable
http://secunia.com/advisories/37471 Not Applicable
http://secunia.com/advisories/38675 Not Applicable
http://support.apple.com/kb/HT3438 Third Party Advisory
http://support.avaya.com/css/P8/documents/100074697 Third Party Advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0149 Broken Link
http://www.securityfocus.com/archive/1/490690/100/0/threaded Mailing List
http://www.securityfocus.com/archive/1/507985/100/0/threaded Mailing List
http://www.securityfocus.com/bid/28715 Third Party Advisory
http://www.securitytracker.com/id?1019823 Broken Link
http://www.vmware.com/security/advisories/VMSA-2009-0016.html Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41748 Third Party Advisory
https://issues.rpath.com/browse/RPL-2444 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8249 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8494 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9407 Signature
URL Date SRC
https://www.exploit-db.com/exploits/31634 2008-04-09
http://securityreason.com/securityalert/3802 2024-08-07
URL Date SRC
URL Date SRC
http://bugs.python.org/issue2586 2022-07-05
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html 2022-07-05
http://security.gentoo.org/glsa/glsa-200807-01.xml 2022-07-05
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.525289 2022-07-05
http://www.debian.org/security/2008/dsa-1551 2022-07-05
http://www.debian.org/security/2008/dsa-1620 2022-07-05
http://www.ubuntu.com/usn/usn-632-1 2022-07-05
https://access.redhat.com/security/cve/CVE-2008-1721 2009-07-27
https://bugzilla.redhat.com/show_bug.cgi?id=442005 2009-07-27
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Python
Search vendor "Python"
 Python
Search vendor "Python" for product "Python"
 >= 2.4.0 < 2.4.6
Search vendor "Python" for product "Python" and version " >= 2.4.0 < 2.4.6"
-
Affected
Python
Search vendor "Python"
 Python
Search vendor "Python" for product "Python"
 >= 2.5.0 <= 2.5.2
Search vendor "Python" for product "Python" and version " >= 2.5.0 <= 2.5.2"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 4.0
Search vendor "Debian" for product "Debian Linux" and version "4.0"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 6.06
Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 7.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "7.04"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 7.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "7.10"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 8.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "8.04"
-
Affected