Executive Summary
Summary | |
---|---|
Title | python security update |
Informations | |||
---|---|---|---|
Name | RHSA-2006:0713 | First vendor Publication | 2006-10-09 |
Vendor | RedHat | Last vendor Modification | 2006-10-09 |
Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated Python packages are now available to correct a security issue in Red Hat Enterprise Linux 3 and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Python is an interpreted, interactive, object-oriented programming language. A flaw was discovered in the way that the Python repr() function handled UTF-32/UCS-4 strings. If an application written in Python used the repr() function on untrusted data, this could lead to a denial of service or possibly allow the execution of arbitrary code with the privileges of the Python application. (CVE-2006-4980) In addition, this errata fixes a regression in the SimpleXMLRPCServer backport for Red Hat Enterprise Linux 3 that was introduced with RHSA-2005:109. Users of Python should upgrade to these updated packages, which contain a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 160418 - Error in RHEL3-U4-errata python python-2.2-xmlfix.patch 208162 - CVE-2006-4980 repr unicode buffer overflow |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2006-0713.html |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10789 | |||
Oval ID: | oval:org.mitre.oval:def:10789 | ||
Title: | Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts. | ||
Description: | Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2006-4980 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-10-10 | Name : SLES9: Security update for Python File : nvt/sles9p5017455.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200610-07 (python) File : nvt/glsa_200610_07.nasl |
2008-09-04 | Name : FreeBSD Ports: python+ipv6 File : nvt/freebsd_python+ipv6.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 1197-1 (python2.4) File : nvt/deb_1197_1.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 1198-1 (python2.3) File : nvt/deb_1198_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
29366 | Python repr() Function Unicode String Overflow |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-04-10 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL16398.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2006-0713.nasl - Type : ACT_GATHER_INFO |
2010-01-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0264.nasl - Type : ACT_GATHER_INFO |
2010-01-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0525.nasl - Type : ACT_GATHER_INFO |
2010-01-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0629.nasl - Type : ACT_GATHER_INFO |
2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_python-2167.nasl - Type : ACT_GATHER_INFO |
2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-359-1.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_python-2168.nasl - Type : ACT_GATHER_INFO |
2007-02-18 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-181.nasl - Type : ACT_GATHER_INFO |
2006-10-25 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1197.nasl - Type : ACT_GATHER_INFO |
2006-10-25 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1198.nasl - Type : ACT_GATHER_INFO |
2006-10-20 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200610-07.nasl - Type : ACT_GATHER_INFO |
2006-10-10 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0713.nasl - Type : ACT_GATHER_INFO |
2006-10-10 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_fe83eb5b55e111dba5ae00508d6a62df.nasl - Type : ACT_GATHER_INFO |
2006-10-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0713.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:50:16 |
|