User: Password:
|
|
Subscribe / Log in / New account

Mageia alert MGASA-2014-0285 (python)

From:  Mageia Updates <buildsystem-daemon@mageia.org>
To:  updates-announce@ml.mageia.org
Subject:  [updates-announce] MGASA-2014-0285: Updated python & python3 packages fix two vulnerabilities
Date:  Wed, 9 Jul 2014 00:35:30 +0200
Message-ID:  <20140708223530.538385A2AF@valstar.mageia.org>

MGASA-2014-0285 - Updated python & python3 packages fix two vulnerabilities Publication date: 08 Jul 2014 URL: http://advisories.mageia.org/MGASA-2014-0285.html Type: security Affected Mageia releases: 3, 4 CVE: CVE-2014-4616, CVE-2014-4650 Description: Updated python and python3 packages fix security vulnerabilities: Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616). The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary scripts in the server's document root (CVE-2014-4650). References: - http://bugs.python.org/issue21766 - http://openwall.com/lists/oss-security/2014/06/26/3 - https://lists.fedoraproject.org/pipermail/package-announc... - https://bugs.mageia.org/show_bug.cgi?id=13588 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4616 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4650 SRPMS: - 4/core/python-2.7.6-1.2.mga4 - 4/core/python3-3.3.2-13.4.mga4 - 3/core/python-2.7.6-1.2.mga3 - 3/core/python3-3.3.0-4.9.mga3


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds