// For flags

CVE-2008-3144

python: Potential integer underflow and overflow in the PyOS_vsnprintf C API function

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Multiple integer overflows in the PyOS_vsnprintf function in Python/mysnprintf.c in Python 2.5.2 and earlier allow context-dependent attackers to cause a denial of service (memory corruption) or have unspecified other impact via crafted input to string formatting operations. NOTE: the handling of certain integer values is also affected by related integer underflows and an off-by-one error.

Múltiples desbordamientos de enterod en la función PyOS_vsnprintf en Python/mysnprintf.c en Python 2.5.2 y anteriores. Permite a atacantes dependientes de contexto causar denegación de servicio (corrupción de la memoria) o tiene otro impacto no especificado a través de entradas manipuladas a operaciones de formateo de cadenas de caracteres. NOTA: el manejo de ciertos valores de enteros está también influenciado por desbordamientos inferiores de enteros relacionados y un error de superación del límite (off-by-one).

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-07-10 CVE Reserved
  • 2008-08-01 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-08-07 First Exploit
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-190: Integer Overflow or Wraparound
CAPEC
References (39)
URL Tag Source
http://bugs.gentoo.org/show_bug.cgi?id=232137 Third Party Advisory
http://secunia.com/advisories/31305 Broken Link
http://secunia.com/advisories/31332 Broken Link
http://secunia.com/advisories/31358 Broken Link
http://secunia.com/advisories/31365 Broken Link
http://secunia.com/advisories/31473 Broken Link
http://secunia.com/advisories/31518 Broken Link
http://secunia.com/advisories/31687 Broken Link
http://secunia.com/advisories/32793 Broken Link
http://secunia.com/advisories/33937 Broken Link
http://secunia.com/advisories/37471 Broken Link
http://support.apple.com/kb/HT3438 Third Party Advisory
http://wiki.rpath.com/Advisories:rPSA-2008-0243 Third Party Advisory
http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5032900 Third Party Advisory
http://www.securityfocus.com/archive/1/495445/100/0/threaded Mailing List
http://www.securityfocus.com/archive/1/507985/100/0/threaded Mailing List
http://www.securityfocus.com/bid/30491 Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2009-0016.html Third Party Advisory
http://www.vupen.com/english/advisories/2008/2288 Broken Link
http://www.vupen.com/english/advisories/2009/3316 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/44171 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/44173 Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10170 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7725 Broken Link
URL Date SRC
http://bugs.python.org/issue2588 2024-08-07
URL Date SRC
URL Date SRC
http://bugs.python.org/issue2589 2023-08-02
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html 2023-08-02
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html 2023-08-02
http://security.gentoo.org/glsa/glsa-200807-16.xml 2023-08-02
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.525289 2023-08-02
http://svn.python.org/view?rev=63728&view=rev 2023-08-02
http://svn.python.org/view?rev=63734&view=rev 2023-08-02
http://svn.python.org/view?rev=63883&view=rev 2023-08-02
http://www.debian.org/security/2008/dsa-1667 2023-08-02
http://www.mandriva.com/security/advisories?name=MDVSA-2008:163 2023-08-02
http://www.mandriva.com/security/advisories?name=MDVSA-2008:164 2023-08-02
http://www.ubuntu.com/usn/usn-632-1 2023-08-02
https://access.redhat.com/security/cve/CVE-2008-3144 2009-07-27
https://bugzilla.redhat.com/show_bug.cgi?id=455018 2009-07-27
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Python
Search vendor "Python"
 Python
Search vendor "Python" for product "Python"
 <= 2.5.2
Search vendor "Python" for product "Python" and version " <= 2.5.2"
-
Affected