suse/python&distro=SUSE Linux Enterprise Module for Basesystem 15

Vulnerabilities (36)

• CVE-2016-0772MedSep 2, 2016
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and th

• CVE-2014-7185Oct 8, 2014
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.

• CVE-2014-1912Mar 1, 2014
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.

• CVE-2013-4238Aug 18, 2013
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a craf

• CVE-2012-1150Oct 5, 2012
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input

• CVE-2012-0845Oct 5, 2012
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of

• CVE-2011-4944Aug 27, 2012
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file.

• CVE-2011-3389Sep 6, 2011
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to ob

• CVE-2011-1521May 24, 2011
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a cra

• CVE-2008-3144Aug 1, 2008
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Multiple integer overflows in the PyOS_vsnprintf function in Python/mysnprintf.c in Python 2.5.2 and earlier allow context-dependent attackers to cause a denial of service (memory corruption) or have unspecified other impact via crafted input to string formatting operations. NOT

• CVE-2008-3143Aug 1, 2008
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Multiple integer overflows in Python before 2.5.2 might allow context-dependent attackers to have an unknown impact via vectors related to (1) Include/pymem.h; (2) _csv.c, (3) _struct.c, (4) arraymodule.c, (5) audioop.c, (6) binascii.c, (7) cPickle.c, (8) cStringIO.c, (9) cjkcode

• CVE-2008-3142Aug 1, 2008
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Multiple buffer overflows in Python 2.5.2 and earlier on 32bit platforms allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a long string that leads to incorrect memory allocation during Unicode string processing, related t

• CVE-2008-2316Aug 1, 2008
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

• CVE-2008-2315Aug 1, 2008
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the (1) stringobject, (2) unicodeobject, (3) bufferobject, (4) longobject, (5) tupleobject, (6) stropmodule, (7) gcmodule, and (8) mmapmodule

• CVE-2008-1721Apr 10, 2008
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and a buffer overflow.

• CVE-2007-2052Apr 16, 2007
  affected < 2.7.17-7.32.2fixed 2.7.17-7.32.2

  Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a bu