Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-python | Aug 30, 2017 | Sep 2, 2016 |
| Amazon_linux | — | amazon-linux-upgrade--python27amazon-linux-upgrade--python34amazon-linux-upgrade-python26 | Jul 22, 2016 | Jul 20, 2016 |
| Apple Osx Python | apple-osx-upgrade-latest | Mar 28, 2017 | Sep 2, 2016 | |
| Debian | debian-upgrade-python2-7 | Mar 31, 2017 | Jun 21, 2016 | |
| Freebsd | freebsd-upgrade-package-python35freebsd-upgrade-package-python34freebsd-upgrade-package-python33freebsd-upgrade-package-python27 | Dec 10, 2025 | Jun 17, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-lang-python | Oct 30, 2017 | Sep 2, 2016 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-pythonhuawei-euleros-2_0_sp1-upgrade-python-develhuawei-euleros-2_0_sp1-upgrade-python-libs | Nov 30, 2017 | Sep 2, 2016 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-runtime-python-27-2-7-9-0-175-3-10-0-3-0oracle-solaris-11-3-upgrade-runtime-python-34-3-4-3-0-175-3-10-0-3-0 | May 29, 2017 | Sep 2, 2016 | |
| Oracle_linux | — | oracle-linux-upgrade-pythonoracle-linux-upgrade-python-debugoracle-linux-upgrade-python-develoracle-linux-upgrade-python-libsoracle-linux-upgrade-python-testoracle-linux-upgrade-python-toolsoracle-linux-upgrade-tkinter | Nov 9, 2016 | Jan 21, 2016 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-pythonredhat-upgrade-python-debugredhat-upgrade-python-debuginforedhat-upgrade-python-develredhat-upgrade-python-libsredhat-upgrade-python-testredhat-upgrade-python-toolsredhat-upgrade-tkinter | Nov 4, 2016 | Sep 2, 2016 | |
| Suse | — | suse-upgrade-libpython2_6-1_0suse-upgrade-libpython2_6-1_0-32bitsuse-upgrade-libpython2_6-1_0-x86suse-upgrade-libpython2_7-1_0suse-upgrade-libpython2_7-1_0-32bitsuse-upgrade-libpython3_4m1_0suse-upgrade-libpython3_4m1_0-32bitsuse-upgrade-libpython3_6m1_0suse-upgrade-libpython3_6m1_0-32bitsuse-upgrade-pythonsuse-upgrade-python-32bitsuse-upgrade-python-basesuse-upgrade-python-base-32bitsuse-upgrade-python-base-x86suse-upgrade-python-cursessuse-upgrade-python-demosuse-upgrade-python-develsuse-upgrade-python-docsuse-upgrade-python-doc-pdfsuse-upgrade-python-gdbmsuse-upgrade-python-idlesuse-upgrade-python-tksuse-upgrade-python-x86suse-upgrade-python-xmlsuse-upgrade-python3suse-upgrade-python3-32bitsuse-upgrade-python3-basesuse-upgrade-python3-base-32bitsuse-upgrade-python3-cursessuse-upgrade-python3-dbmsuse-upgrade-python3-develsuse-upgrade-python3-idlesuse-upgrade-python3-testsuitesuse-upgrade-python3-tksuse-upgrade-python3-tools | Sep 2, 2016 | Sep 2, 2016 |
| Ubuntu | ubuntu-upgrade-libpython2-7ubuntu-upgrade-libpython2-7-minimalubuntu-upgrade-libpython2-7-stdlibubuntu-upgrade-libpython3-2ubuntu-upgrade-libpython3-4ubuntu-upgrade-libpython3-4-minimalubuntu-upgrade-libpython3-4-stdlibubuntu-upgrade-libpython3-5ubuntu-upgrade-libpython3-5-minimalubuntu-upgrade-libpython3-5-stdlibubuntu-upgrade-python2-7ubuntu-upgrade-python2-7-minimalubuntu-upgrade-python3-2ubuntu-upgrade-python3-2-minimalubuntu-upgrade-python3-4ubuntu-upgrade-python3-4-minimalubuntu-upgrade-python3-5ubuntu-upgrade-python3-5-minimal | Nov 23, 2016 | Sep 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub