CVE-2008-5983

Una vulnerabilidad de ruta de búsqueda no confiable en la función API PySys_SetArgv en Python versión 2.6 y anteriores, y posiblemente versiones posteriores, antepone una cadena vacía al archivo sys.path cuando el argumento argv [0] no contiene un separador de ruta, lo que podría permitir a los usuarios locales ejecutar código arbitrario por medio de un archivo Python de tipo caballo de Troya en el directorio de trabajo actual.

It was discovered that Python would prepend an empty string to sys.path under certain circumstances. A local attacker with write access to the current working directory could exploit this to execute arbitrary code. This issue only affected Ubuntu 10.04 LTS. It was discovered that the audioop module did not correctly perform input validation. If a user or automated system were tricked into opening a crafted audio file, an attacker could cause a denial of service via application crash. These issues only affected Ubuntu 10.04 LTS. Various other issues were also addressed.