rpm package
suse/python3&distro=SUSE Linux Enterprise Module for Web and Scripting 12
pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012
Vulnerabilities (53)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-1000802 | Cri | 9.8 | < 3.4.6-25.29.1 | 3.4.6-25.29.1 | Sep 18, 2018 | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injecti | |
| CVE-2018-1061 | Med | 6.5 | < 3.4.6-25.16.1 | 3.4.6-25.16.1 | Jun 19, 2018 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service. | |
| CVE-2018-1060 | Hig | 7.5 | < 3.4.6-25.16.1 | 3.4.6-25.16.1 | Jun 18, 2018 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service. | |
| CVE-2016-9063 | Cri | 9.8 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jun 11, 2018 | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. | |
| CVE-2017-18207 | Med | 6.5 | < 3.4.6-25.7.1 | 3.4.6-25.7.1 | Mar 1, 2018 | The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue beca | |
| CVE-2017-1000158 | Cri | 9.8 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Nov 17, 2017 | CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution) | |
| CVE-2017-9233 | Hig | 7.5 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jul 25, 2017 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD. | |
| CVE-2016-5699 | Med | 6.1 | < 3.4.5-17.1 | 3.4.5-17.1 | Sep 2, 2016 | CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL. | |
| CVE-2016-5636 | Cri | 9.8 | < 3.4.5-17.1 | 3.4.5-17.1 | Sep 2, 2016 | Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow. | |
| CVE-2016-0772 | Med | 6.5 | < 3.4.5-17.1 | 3.4.5-17.1 | Sep 2, 2016 | The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and th | |
| CVE-2016-4472 | Hig | 8.1 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jun 30, 2016 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix f | |
| CVE-2016-0718 | Cri | 9.8 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | May 26, 2016 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. | |
| CVE-2012-0876 | — | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jul 3, 2012 | The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the sa |
- affected < 3.4.6-25.29.1fixed 3.4.6-25.29.1
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injecti
- affected < 3.4.6-25.16.1fixed 3.4.6-25.16.1
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.
- affected < 3.4.6-25.16.1fixed 3.4.6-25.16.1
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
- affected < 3.4.6-25.7.1fixed 3.4.6-25.7.1
The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue beca
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
- affected < 3.4.5-17.1fixed 3.4.5-17.1
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
- affected < 3.4.5-17.1fixed 3.4.5-17.1
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
- affected < 3.4.5-17.1fixed 3.4.5-17.1
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and th
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix f
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
- CVE-2012-0876Jul 3, 2012affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the sa
Page 3 of 3