rpm package
suse/python3&distro=SUSE Linux Enterprise Server 12 SP2-BCL
pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL
Vulnerabilities (29)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-20406 | — | < 3.4.6-25.21.1 | 3.4.6-25.21.1 | Dec 23, 2018 | Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundr | ||
| CVE-2018-14647 | Hig | 7.5 | < 3.4.6-25.29.1 | 3.4.6-25.29.1 | Sep 25, 2018 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data struc | |
| CVE-2018-1000802 | Cri | 9.8 | < 3.4.6-25.29.1 | 3.4.6-25.29.1 | Sep 18, 2018 | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injecti | |
| CVE-2016-9063 | Cri | 9.8 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jun 11, 2018 | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. | |
| CVE-2017-1000158 | Cri | 9.8 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Nov 17, 2017 | CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution) | |
| CVE-2017-9233 | Hig | 7.5 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jul 25, 2017 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD. | |
| CVE-2016-4472 | Hig | 8.1 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jun 30, 2016 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix f | |
| CVE-2016-0718 | Cri | 9.8 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | May 26, 2016 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. | |
| CVE-2012-0876 | — | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jul 3, 2012 | The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the sa |
- CVE-2018-20406Dec 23, 2018affected < 3.4.6-25.21.1fixed 3.4.6-25.21.1
Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundr
- affected < 3.4.6-25.29.1fixed 3.4.6-25.29.1
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data struc
- affected < 3.4.6-25.29.1fixed 3.4.6-25.29.1
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injecti
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix f
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
- CVE-2012-0876Jul 3, 2012affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the sa
Page 2 of 2