Advisories » MGASA-2014-0285

Updated python & python3 packages fix two vulnerabilities

Publication date: 08 Jul 2014
Modification date: 08 Jul 2014
Type: security
Affected Mageia releases : 3 , 4
CVE: CVE-2014-4616 , CVE-2014-4650

Description

Updated python and python3 packages fix security vulnerabilities:

Python 2 and 3 are susceptible to arbitrary process memory reading by a user
or adversary due to a bug in the _json module caused by insufficient bounds
checking. The bug is caused by allowing the user to supply a negative value
that is used an an array index, causing the scanstring function to access
process memory outside of the string it is intended to access
(CVE-2014-4616).

The CGIHTTPServer Python module does not properly handle URL-encoded path
separators in URLs. This may enable attackers to disclose a CGI script's
source code or execute arbitrary scripts in the server's document root
(CVE-2014-4650).
                

References

• http://bugs.python.org/issue21766
• http://openwall.com/lists/oss-security/2014/06/26/3
• https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134903.html
• https://bugs.mageia.org/show_bug.cgi?id=13588
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4616
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4650

SRPMS

3/core

• python-2.7.6-1.2.mga3
• python3-3.3.0-4.9.mga3

4/core

• python-2.7.6-1.2.mga4
• python3-3.3.2-13.4.mga4