Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade python3 | Apr 24, 2019 | Dec 23, 2018 |
| Amazon Linux Ami 2 | — | Upgrade python-debuginfoUpgrade python-debugUpgrade python3-debugUpgrade python3-tkinterUpgrade python3-debuginfoUpgrade python3-libsUpgrade pythonUpgrade python3-develUpgrade python3-toolsUpgrade python-testUpgrade python3-testUpgrade python-develUpgrade python-libsUpgrade tkinterUpgrade python3Upgrade python-tools | Apr 27, 2020 | Dec 23, 2018 |
| Amazon_linux | — | Upgrade python34 | May 7, 2019 | Dec 23, 2018 |
| Debian | — | Upgrade python3.7 | Feb 20, 2019 | Dec 23, 2018 |
| Oracle Solaris | — | Upgrade runtime/python-34 to version 3.4.10-0.175.3.36.0.26.0 on Solaris 11.3Upgrade library/python/tkinter-27 to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-35 to version 3.5.7-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-34 to version 3.4.10-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-34 to version 3.4.10-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-35 to version 3.5.7-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-34 to version 3.4.10-0.175.3.36.0.26.0 on Solaris 11.3Upgrade runtime/python-37 to version 3.7.4-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-27/tests to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-37 to version 3.7.4-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4 | Aug 21, 2019 | Dec 23, 2018 |
| Suse | — | Upgrade libfreebl3-32bitUpgrade MozillaFirefoxUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade python3-tkUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-dataUpgrade python3-idleUpgrade python36Upgrade mozilla-nspr-develUpgrade libfirefox-gio-2_0-0Upgrade libfirefox-gthread-2_0-0Upgrade firefox-libatk-1_0-0Upgrade libpython3_4m1_0Upgrade python3-base-32bitUpgrade python3-testsuiteUpgrade python3-cursesUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nss-32bitUpgrade MozillaFirefox-translations-commonUpgrade mozilla-nss-develUpgrade python36-baseUpgrade python3-32bitUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nss-toolsUpgrade firefox-libffi4Upgrade libsoftokn3Upgrade firefox-gtk3-immodules-tigrignaUpgrade libpython3_6m1_0Upgrade python3-develUpgrade firefox-gtk3-langUpgrade mozilla-nsprUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-certsUpgrade libfirefox-glib-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-gio-branding-upstreamUpgrade firefox-libharfbuzz0Upgrade libpython3_6m1_0-32bitUpgrade mozilla-nss-certs-32bitUpgrade firefox-libgtk-3-0Upgrade firefox-glib2-langUpgrade python3Upgrade libfirefox-gobject-2_0-0Upgrade MozillaFirefox-translations-otherUpgrade firefox-libpango-1_0-0Upgrade python3-dbmUpgrade firefox-glib2-toolsUpgrade python3-baseUpgrade python3-toolsUpgrade firefox-gtk3-branding-upstreamUpgrade libpython3_4m1_0-32bitUpgrade firefox-libcairo2Upgrade firefox-libcairo-gobject2Upgrade firefox-gdk-pixbuf-query-loadersUpgrade python3-docUpgrade firefox-gtk3-toolsUpgrade firefox-atk-langUpgrade libfreebl3Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-libffi7Upgrade mozilla-nssUpgrade firefox-gtk3-immodule-xim | Feb 6, 2019 | Dec 23, 2018 |
| Ubuntu | — | Upgrade python3.5Upgrade python3.5-minimalUpgrade python3.4 (Ubuntu Pro)Upgrade python2.7-minimalUpgrade python3.4-minimal (Ubuntu Pro)Upgrade python2.7-minimal (Ubuntu Pro)Upgrade python2.7 (Ubuntu Pro)Upgrade python3.6Upgrade python3.5-minimal (Ubuntu Pro)Upgrade python2.7Upgrade python3.5 (Ubuntu Pro)Upgrade python3.6-minimal | Sep 10, 2019 | Dec 23, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 23, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub