CVE-2016-5636

原始描述

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

受影响的软件

• Python = 3.3.4= 3.5.0= 3.2.5= 3.2.3= 3.1.1= 3.4.1 精确匹配

详情

发布日期

2016-09-02

最后修改

2024-08-06

CVSS 向量

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

参考资料

• cve.org/CVE-2016-5636
• nvd.nist.gov/vuln/detail/CVE-2016-5636
• www.splunk.com/view/SP-CAAAPUE
• www.openwall.com/lists/oss-security/2016/06/16/1
• www.splunk.com/view/SP-CAAAPSV
• lists.debian.org/debian-lts-announce/2019/02/msg00011.html
• docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5
• www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
• bugs.python.org/issue26171
• hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS
• www.securitytracker.com/id/1038138
• www.securityfocus.com/bid/91247
• security.gentoo.org/glsa/201701-18
• docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2