5.9 - CVE-2014-4616

Executive Summary

Informations
Name	CVE-2014-4616	First vendor Publication	2017-08-24
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Overall CVSS Score	5.9
Base Score	5.9	Environmental Score	5.9
impact SubScore	3.6	Temporal Score	5.9
Exploitabality Sub Score	2.2

Attack Vector	Network	Attack Complexity	High
Privileges Required	None	User Interaction	None
Scope	Unchanged	Confidentiality Impact	High
Integrity Impact	None	Availability Impact	None
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Cvss Base Score	4.3	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4616

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-129	Improper Validation of Array Index

CPE : Common Platform Enumeration

Type	Description	Count
Application	Python cpe:2.3:a:python:python:3.4.0:-:::::: cpe:2.3:a:python:python:3.4.0:alpha1:::::: cpe:2.3:a:python:python:3.4.0:alpha2:::::: cpe:2.3:a:python:python:3.4.0:alpha3:::::: cpe:2.3:a:python:python:3.4.0:alpha4:::::: cpe:2.3:a:python:python:3.4.0:beta1:::::: cpe:2.3:a:python:python:3.4.0:beta2:::::: cpe:2.3:a:python:python:3.4.0:beta3:::::: cpe:2.3:a:python:python:3.4.0:rc1:::::: cpe:2.3:a:python:python:3.4.0:rc2:::::: cpe:2.3:a:python:python:3.4.0:rc3:::::: cpe:2.3:a:python:python:3.4:alpha1:::::: cpe:2.3:a:python:python:3.3.7:-:::::: cpe:2.3:a:python:python:3.3.7:rc1:::::: cpe:2.3:a:python:python:3.3.6:rc1:::::: cpe:2.3:a:python:python:3.3.6:-:::::: cpe:2.3:a:python:python:3.3.5:rc2:::::: cpe:2.3:a:python:python:3.3.5:-:::::: cpe:2.3:a:python:python:3.3.5:rc1:::::: cpe:2.3:a:python:python:3.3.4:rc1:::::: cpe:2.3:a:python:python:3.3.4:-:::::: cpe:2.3:a:python:python:3.3.3:rc1:::::: cpe:2.3:a:python:python:3.3.3:rc2:::::: cpe:2.3:a:python:python:3.3.3:-:::::: cpe:2.3:a:python:python:3.3.2:::::::* cpe:2.3:a:python:python:3.3.1:rc1:::::: cpe:2.3:a:python:python:3.3.1:-:::::: cpe:2.3:a:python:python:3.3.0:-:::::: cpe:2.3:a:python:python:3.3.0:alpha1:::::: cpe:2.3:a:python:python:3.3.0:alpha2:::::: cpe:2.3:a:python:python:3.3.0:alpha3:::::: cpe:2.3:a:python:python:3.3.0:alpha4:::::: cpe:2.3:a:python:python:3.3.0:beta1:::::: cpe:2.3:a:python:python:3.3.0:beta2:::::: cpe:2.3:a:python:python:3.3.0:rc1:::::: cpe:2.3:a:python:python:3.3.0:rc2:::::: cpe:2.3:a:python:python:3.3.0:rc3:::::: cpe:2.3:a:python:python:3.3:beta2:::::: cpe:2.3:a:python:python:3.3:::::::* cpe:2.3:a:python:python:3.2.6:-:::::: cpe:2.3:a:python:python:3.2.6:rc1:::::: cpe:2.3:a:python:python:3.2.5:::::::* cpe:2.3:a:python:python:3.2.4:-:::::: cpe:2.3:a:python:python:3.2.4:rc1:::::: cpe:2.3:a:python:python:3.2.3:-:::::: cpe:2.3:a:python:python:3.2.3:rc1:::::: cpe:2.3:a:python:python:3.2.3:rc2:::::: cpe:2.3:a:python:python:3.2.2150:::::::* cpe:2.3:a:python:python:3.2.2:-:::::: cpe:2.3:a:python:python:3.2.2:rc1:::::: cpe:2.3:a:python:python:3.2.1:-:::::: cpe:2.3:a:python:python:3.2.1:beta1:::::: cpe:2.3:a:python:python:3.2.1:rc1:::::: cpe:2.3:a:python:python:3.2.1:rc2:::::: cpe:2.3:a:python:python:3.2.0:::::::* cpe:2.3:a:python:python:3.2:alpha:::::: cpe:2.3:a:python:python:3.2:-:::::: cpe:2.3:a:python:python:3.2:alpha1:::::: cpe:2.3:a:python:python:3.2:alpha2:::::: cpe:2.3:a:python:python:3.2:alpha3:::::: cpe:2.3:a:python:python:3.2:alpha4:::::: cpe:2.3:a:python:python:3.2:beta1:::::: cpe:2.3:a:python:python:3.2:beta2:::::: cpe:2.3:a:python:python:3.2:rc1:::::: cpe:2.3:a:python:python:3.2:rc2:::::: cpe:2.3:a:python:python:3.2:rc3:::::: cpe:2.3:a:python:python:3.1.5:-:::::: cpe:2.3:a:python:python:3.1.5:rc1:::::: cpe:2.3:a:python:python:3.1.5:rc2:::::: cpe:2.3:a:python:python:3.1.4:-:::::: cpe:2.3:a:python:python:3.1.4:rc1:::::: cpe:2.3:a:python:python:3.1.3:-:::::: cpe:2.3:a:python:python:3.1.3:rc1:::::: cpe:2.3:a:python:python:3.1.2150::::::x64: cpe:2.3:a:python:python:3.1.2:-:::::: cpe:2.3:a:python:python:3.1.2:rc1:::::: cpe:2.3:a:python:python:3.1.1:-:::::: cpe:2.3:a:python:python:3.1.1:rc1:::::: cpe:2.3:a:python:python:3.1.0:::::::* cpe:2.3:a:python:python:3.1:-:::::: cpe:2.3:a:python:python:3.1:alpha1:::::: cpe:2.3:a:python:python:3.1:alpha2:::::: cpe:2.3:a:python:python:3.1:beta1:::::: cpe:2.3:a:python:python:3.1:rc1:::::: cpe:2.3:a:python:python:3.1:rc2:::::: cpe:2.3:a:python:python:3.0.1:::::::* cpe:2.3:a:python:python:3.0.0:::::::* cpe:2.3:a:python:python:3.0:-:::::: cpe:2.3:a:python:python:3.0:alpha1:::::: cpe:2.3:a:python:python:3.0:alpha2:::::: cpe:2.3:a:python:python:3.0:alpha3:::::: cpe:2.3:a:python:python:3.0:alpha4:::::: cpe:2.3:a:python:python:3.0:alpha5:::::: cpe:2.3:a:python:python:3.0:beta1:::::: cpe:2.3:a:python:python:3.0:beta2:::::: cpe:2.3:a:python:python:3.0:beta3:::::: cpe:2.3:a:python:python:3.0:rc1:::::: cpe:2.3:a:python:python:3.0:rc2:::::: cpe:2.3:a:python:python:3.0:rc3:::::: cpe:2.3:a:python:python:2.7.9:-:::::: cpe:2.3:a:python:python:2.7.9:rc1:::::: cpe:2.3:a:python:python:2.7.8:::::::* cpe:2.3:a:python:python:2.7.7:-:::::: cpe:2.3:a:python:python:2.7.7:rc1:::::: cpe:2.3:a:python:python:2.7.6:-:::::: cpe:2.3:a:python:python:2.7.6:rc1:::::: cpe:2.3:a:python:python:2.7.5:::::::* cpe:2.3:a:python:python:2.7.4:-:::::: cpe:2.3:a:python:python:2.7.4:rc1:::::: cpe:2.3:a:python:python:2.7.3:-:::::: cpe:2.3:a:python:python:2.7.3:rc1:::::: cpe:2.3:a:python:python:2.7.3:rc2:::::: cpe:2.3:a:python:python:2.7.2150:::::::* cpe:2.3:a:python:python:2.7.2:rc1:::::: cpe:2.3:a:python:python:2.7.2:-:::::: cpe:2.3:a:python:python:2.7.16:-:::::: cpe:2.3:a:python:python:2.7.16:rc1:::::: cpe:2.3:a:python:python:2.7.16:::::::* cpe:2.3:a:python:python:2.7.15:-:::::: cpe:2.3:a:python:python:2.7.15:rc1:::::: cpe:2.3:a:python:python:2.7.14:-:::::: cpe:2.3:a:python:python:2.7.14:rc1:::::: cpe:2.3:a:python:python:2.7.13:-:::::: cpe:2.3:a:python:python:2.7.13:rc1:::::: cpe:2.3:a:python:python:2.7.12:-:::::: cpe:2.3:a:python:python:2.7.12:rc1:::::: cpe:2.3:a:python:python:2.7.1150:::::::* cpe:2.3:a:python:python:2.7.1150::::::x64: cpe:2.3:a:python:python:2.7.11:-:::::: cpe:2.3:a:python:python:2.7.11:rc1:::::: cpe:2.3:a:python:python:2.7.10:-:::::: cpe:2.3:a:python:python:2.7.10:rc1:::::: cpe:2.3:a:python:python:2.7.1:-:::::: cpe:2.3:a:python:python:2.7.1:rc1:::::: cpe:2.3:a:python:python:2.7.0:::::::* cpe:2.3:a:python:python:2.6.9:::::::* cpe:2.3:a:python:python:2.6.8:::::::* cpe:2.3:a:python:python:2.6.7:::::::* cpe:2.3:a:python:python:2.6.6150:::::::* cpe:2.3:a:python:python:2.6.6:::::::* cpe:2.3:a:python:python:2.6.5:::::::* cpe:2.3:a:python:python:2.6.4:::::::* cpe:2.3:a:python:python:2.6.3:::::::* cpe:2.3:a:python:python:2.6.2150:::::::* cpe:2.3:a:python:python:2.6.2:::::::* cpe:2.3:a:python:python:2.6.1:::::::* cpe:2.3:a:python:python:2.6.0:::::::* cpe:2.3:a:python:python:2.5.6:::::::* cpe:2.3:a:python:python:2.5.5:::::::* cpe:2.3:a:python:python:2.5.4:::::::* cpe:2.3:a:python:python:2.5.3:::::::* cpe:2.3:a:python:python:2.5.2:::::::* cpe:2.3:a:python:python:2.5.150:::::::* cpe:2.3:a:python:python:2.5.1:::::::* cpe:2.3:a:python:python:2.5.0:::::::* cpe:2.3:a:python:python:2.4.6:::::::* cpe:2.3:a:python:python:2.4.5:::::::* cpe:2.3:a:python:python:2.4.4:::::::* cpe:2.3:a:python:python:2.4.3:::::::* cpe:2.3:a:python:python:2.4.2:::::::* cpe:2.3:a:python:python:2.4.1:::::::* cpe:2.3:a:python:python:2.4.0:::::::* cpe:2.3:a:python:python:2.3.7:::::::* cpe:2.3:a:python:python:2.3.6:::::::* cpe:2.3:a:python:python:2.3.5:::::::* cpe:2.3:a:python:python:2.3.4:::::::* cpe:2.3:a:python:python:2.3.3:::::::* cpe:2.3:a:python:python:2.3.2:::::::* cpe:2.3:a:python:python:2.3.1:::::::* cpe:2.3:a:python:python:2.3.0:::::::* cpe:2.3:a:python:python:2.2.3:::::::* cpe:2.3:a:python:python:2.2.2:::::::* cpe:2.3:a:python:python:2.2.1:::::::* cpe:2.3:a:python:python:2.2.0:::::::* cpe:2.3:a:python:python:2.2:::::::* cpe:2.3:a:python:python:2.1.3:::::::* cpe:2.3:a:python:python:2.1.2:::::::* cpe:2.3:a:python:python:2.1.1:::::::* cpe:2.3:a:python:python:2.1:::::::* cpe:2.3:a:python:python:2.0.1:::::::* cpe:2.3:a:python:python:2.0:::::::* cpe:2.3:a:python:python:1.6.1:::::::* cpe:2.3:a:python:python:1.6:::::::* cpe:2.3:a:python:python:1.5.2:::::::* cpe:2.3:a:python:python:1.3:::::::* cpe:2.3:a:python:python:1.2:::::::* cpe:2.3:a:python:python:0.9.1:::::::* cpe:2.3:a:python:python:0.9.0:::::::* cpe:2.3:a:python:python:::::::: cpe:2.3:a:python:python:-:::::::*	190
Application	Simplejson Project Simplejson cpe:2.3:a:simplejson_project:simplejson::::::python::*	1
Os	Opensuse cpe:2.3:o:opensuse:opensuse:13.1:::::::*	1
Os	Opensuse Project Opensuse cpe:2.3:o:opensuse_project:opensuse:12.3:::::::*	1

Nessus® Vulnerability Scanner

Date	Description
2015-12-22	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20151119_python_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2015-12-02	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-2101.nasl - Type : ACT_GATHER_INFO
2015-11-24	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-2101.nasl - Type : ACT_GATHER_INFO
2015-11-20	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-2101.nasl - Type : ACT_GATHER_INFO
2015-06-26	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2653-1.nasl - Type : ACT_GATHER_INFO
2015-03-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-076.nasl - Type : ACT_GATHER_INFO
2015-03-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-075.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201503-10.nasl - Type : ACT_GATHER_INFO
2014-11-14	Name : The remote Fedora host is missing a security update. File : fedora_2014-14257.nasl - Type : ACT_GATHER_INFO
2014-11-11	Name : The remote Fedora host is missing a security update. File : fedora_2014-14208.nasl - Type : ACT_GATHER_INFO
2014-11-10	Name : The remote Fedora host is missing a security update. File : fedora_2014-14245.nasl - Type : ACT_GATHER_INFO
2014-10-12	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-380.nasl - Type : ACT_GATHER_INFO
2014-10-12	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-374.nasl - Type : ACT_GATHER_INFO
2014-07-17	Name : The remote Fedora host is missing a security update. File : fedora_2014-8035.nasl - Type : ACT_GATHER_INFO
2014-07-17	Name : The remote Fedora host is missing a security update. File : fedora_2014-7772.nasl - Type : ACT_GATHER_INFO
2014-07-14	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-458.nasl - Type : ACT_GATHER_INFO
2014-07-11	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-135.nasl - Type : ACT_GATHER_INFO
2014-07-01	Name : The remote Fedora host is missing a security update. File : fedora_2014-7800.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://bugs.python.org/issue21529
http://lists.opensuse.org/opensuse-updates/2014-07/msg00015.html
http://openwall.com/lists/oss-security/2014/06/24/7
http://rhn.redhat.com/errata/RHSA-2015-1064.html
http://www.securityfocus.com/bid/68119
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752395
https://bugzilla.redhat.com/show_bug.cgi?id=1112285
https://hackerone.com/reports/12297
https://security.gentoo.org/glsa/201503-10

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 12:41:45	Multiple Updates
2024-08-02 12:29:04	Multiple Updates
2024-08-02 01:08:41	Multiple Updates
2024-02-02 01:28:14	Multiple Updates
2024-02-01 12:08:21	Multiple Updates
2023-09-05 12:26:46	Multiple Updates
2023-09-05 01:08:14	Multiple Updates
2023-09-02 12:26:46	Multiple Updates
2023-09-02 01:08:22	Multiple Updates
2023-08-12 12:29:08	Multiple Updates
2023-08-12 01:07:51	Multiple Updates
2023-08-11 12:24:53	Multiple Updates
2023-08-11 01:08:03	Multiple Updates
2023-08-06 12:24:11	Multiple Updates
2023-08-06 01:07:50	Multiple Updates
2023-08-04 12:24:15	Multiple Updates
2023-08-04 01:07:54	Multiple Updates
2023-07-14 12:24:13	Multiple Updates
2023-07-14 01:07:53	Multiple Updates
2023-03-29 01:26:03	Multiple Updates
2023-03-28 12:08:13	Multiple Updates
2022-10-11 12:21:52	Multiple Updates
2022-10-11 01:08:01	Multiple Updates
2022-07-13 21:27:55	Multiple Updates
2021-05-04 12:32:39	Multiple Updates
2021-04-22 01:40:02	Multiple Updates
2021-01-07 12:11:45	Multiple Updates
2020-07-10 12:10:35	Multiple Updates
2020-05-23 01:52:36	Multiple Updates
2020-05-23 00:41:36	Multiple Updates
2018-10-31 00:20:38	Multiple Updates
2018-01-26 12:05:38	Multiple Updates
2018-01-05 09:23:24	Multiple Updates
2017-12-30 00:22:07	Multiple Updates
2017-09-08 05:22:15	Multiple Updates
2017-08-26 09:22:40	Multiple Updates
2017-08-25 05:22:26	First insertion

Global Informations

Type	Count
CWE ID(s)	1
CPE ID(s)	193
Sources(s)	9
Nessus® Exploit(s)	18

	Related
7.5	RHSA-2015:1064
7.5	MDVSA-2015:076
7.5	MDVSA-2015:075
7.5	GLSA-201503-10
6.4	USN-2653-1
6.4	RHSA-2015:2101
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 6 more Alert(s)

5.9 - CVE-2014-4616

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

CPE : Common Platform Enumeration

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU