Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade python | Aug 30, 2017 | Sep 2, 2016 |
| Amazon_linux | — | Upgrade python34Upgrade python26Upgrade python27 | Jul 22, 2016 | Jul 20, 2016 |
| Apple Osx Python | — | Upgrade macOS to the latest version | Mar 28, 2017 | Sep 2, 2016 |
| Debian | — | Upgrade python2.7 | Mar 31, 2017 | Jun 21, 2016 |
| F5 Big Ip | — | — | May 24, 2024 | Sep 2, 2016 |
| Freebsd | — | Upgrade python27Upgrade python33Upgrade python35Upgrade python34 | Dec 10, 2025 | Jun 17, 2016 |
| Gentoo Linux | — | Upgrade dev-lang/python. | Oct 30, 2017 | Sep 2, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade pythonUpgrade python-develUpgrade python-libs | Nov 30, 2017 | Sep 2, 2016 |
| Oracle Solaris | — | Upgrade runtime/python-34 to version 3.4.3-0.175.3.10.0.3.0 on Solaris 11.3Upgrade runtime/python-27 to version 2.7.9-0.175.3.10.0.3.0 on Solaris 11.3 | May 29, 2017 | Sep 2, 2016 |
| Oracle_linux | — | Upgrade python-debugUpgrade python-libsUpgrade python-develUpgrade pythonUpgrade tkinterUpgrade python-testUpgrade python-tools | Nov 9, 2016 | Jan 21, 2016 |
| Redhat_linux | — | Upgrade python-toolsUpgrade tkinterNo solution existsUpgrade python-testUpgrade python-debuginfoUpgrade python-libsUpgrade pythonUpgrade python-develUpgrade python-debug | Nov 4, 2016 | Sep 2, 2016 |
| Suse | — | Upgrade libpython2_6-1_0-x86Upgrade python-base-32bitUpgrade libpython2_7-1_0-32bitUpgrade python3Upgrade python3-toolsUpgrade python-doc-pdfUpgrade python-baseUpgrade python-base-x86Upgrade python-demoUpgrade python3-baseUpgrade python3-dbmUpgrade libpython3_4m1_0-32bitUpgrade pythonUpgrade libpython2_6-1_0-32bitUpgrade python-idleUpgrade libpython3_6m1_0-32bitUpgrade python-docUpgrade python-xmlUpgrade python3-tkUpgrade python-32bitUpgrade python3-testsuiteUpgrade python3-base-32bitUpgrade libpython3_4m1_0Upgrade python-cursesUpgrade python-x86Upgrade libpython3_6m1_0Upgrade python3-cursesUpgrade python3-32bitUpgrade python-gdbmUpgrade libpython2_6-1_0Upgrade python-develUpgrade python3-develUpgrade python3-idleUpgrade python-tkUpgrade libpython2_7-1_0 | Sep 2, 2016 | Sep 2, 2016 |
| Ubuntu | — | Upgrade libpython3.5-stdlibUpgrade libpython3.4Upgrade libpython3.2Upgrade python2.7Upgrade python3.5Upgrade libpython2.7Upgrade libpython3.4-stdlibUpgrade python3.4Upgrade python3.4-minimalUpgrade libpython2.7-minimalUpgrade python3.2-minimalUpgrade libpython2.7-stdlibUpgrade python3.5-minimalUpgrade libpython3.5-minimalUpgrade python2.7-minimalUpgrade libpython3.4-minimalUpgrade python3.2Upgrade libpython3.5 | Nov 23, 2016 | Sep 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub