Vulnerability Details : CVE-2008-3142
Multiple buffer overflows in Python 2.5.2 and earlier on 32bit platforms allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a long string that leads to incorrect memory allocation during Unicode string processing, related to the unicode_resize function and the PyMem_RESIZE macro.
Vulnerability category: OverflowDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2008-3142
Probability of exploitation activity in the next 30 days: 0.23%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 60 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-3142
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
[email protected] |
CWE ids for CVE-2008-3142
-
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.Assigned by: [email protected] (Primary)
References for CVE-2008-3142
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/44173
Third Party Advisory;VDB Entry
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:164
Broken Link
-
http://www.securityfocus.com/archive/1/495445/100/0/threaded
Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/30491
Third Party Advisory;VDB Entry
-
http://wiki.rpath.com/Advisories:rPSA-2008-0243
Broken Link
-
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
Third Party Advisory
-
http://www.vupen.com/english/advisories/2009/3316
Permissions Required
-
http://bugs.python.org/file10825/issue2620-gps02-patch.txt
Exploit;Issue Tracking;Third Party Advisory
-
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.525289
Third Party Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11466
Third Party Advisory
-
http://www.vupen.com/english/advisories/2008/2288
Permissions Required
-
http://www.debian.org/security/2008/dsa-1667
Third Party Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/44170
Third Party Advisory;VDB Entry
-
http://bugs.python.org/issue2620
Issue Tracking;Third Party Advisory
-
http://www.ubuntu.com/usn/usn-632-1
Third Party Advisory
-
http://security.gentoo.org/glsa/glsa-200807-16.xml
Third Party Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8422
Third Party Advisory
-
http://support.apple.com/kb/HT3438
Third Party Advisory
-
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
Mailing List;Third Party Advisory
-
http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5032900
Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
Mailing List;Third Party Advisory
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:163
Broken Link
-
http://www.securityfocus.com/archive/1/507985/100/0/threaded
Third Party Advisory;VDB Entry
-
http://bugs.gentoo.org/show_bug.cgi?id=232137
Issue Tracking;Third Party Advisory
Products affected by CVE-2008-3142
- cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*