CVE-2016-5636

원문 설명

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

영향받는 소프트웨어

• Python = 3.3.4= 3.5.0= 3.2.5= 3.2.3= 3.1.1= 3.4.1 정확 일치

상세

공개일

2016-09-02

최종 수정

2024-08-06

CVSS 벡터

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

참고 자료

• cve.org/CVE-2016-5636
• nvd.nist.gov/vuln/detail/CVE-2016-5636
• www.splunk.com/view/SP-CAAAPUE
• www.openwall.com/lists/oss-security/2016/06/16/1
• www.splunk.com/view/SP-CAAAPSV
• lists.debian.org/debian-lts-announce/2019/02/msg00011.html
• docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5
• www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
• bugs.python.org/issue26171
• hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS
• www.securitytracker.com/id/1038138
• www.securityfocus.com/bid/91247
• security.gentoo.org/glsa/201701-18
• docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2