MGASA-2014-0285
- Source
- https://advisories.mageia.org/MGASA-2014-0285.html
- Import Source
- https://advisories.mageia.org/MGASA-2014-0285.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2014-0285
- Related
- Published
- 2014-07-08T22:35:18Z
- Modified
- 2014-07-08T22:35:06Z
- Summary
- Updated python & python3 packages fix two vulnerabilities
- Details
-
Updated python and python3 packages fix security vulnerabilities:
Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616).
The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary scripts in the server's document root (CVE-2014-4650).
- References
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:4 / python
Package
- Name
- python
- Purl
- pkg:rpm/mageia/python?distro=mageia-4
Mageia:4 / python3
Package
- Name
- python3
- Purl
- pkg:rpm/mageia/python3?distro=mageia-4
Mageia:3 / python
Package
- Name
- python
- Purl
- pkg:rpm/mageia/python?distro=mageia-3
Mageia:3 / python3
Package
- Name
- python3
- Purl
- pkg:rpm/mageia/python3?distro=mageia-3