CVE-2014-4616

Debian Bug report logs - #752395 python27: CVE-2014-4616: JSON module: reading arbitrary process memory Package: python27; Maintainer for python27 is Matthias Klose <doko@debianorg>; Source for python27 is src:python27 (PTS, buildd, popcon) Reported by: Gert van Dijk <gertvdijk@gmailcom> Date: Mon, 23 Jun 2014 ...

Several security issues were fixed in Python ...

It was <a href="bugspythonorg/issue21529"</a>reported</a> that Python built-in _json module have a flaw (insufficient bounds checking), which allows a local user to read current process' arbitrary memory Quoting the upstream bug report: <i>The sole prerequisites of this attack are that the attacker is able to control ...

It was <a href="bugspythonorg/issue21529">reported</a> that Python built-in _json module have a flaw (insufficient bounds checking), which allows a local user to read current process' arbitrary memory Quoting the upstream bug report: <i>The sole prerequisites of this attack are that the attacker is able to control or inf ...

A flaw was found in the way the json module handled negative index argument passed to certain functions (such as raw_decode()) An attacker able to control index value passed to one of the affected functions could possibly use this flaw to disclose portions of the application memory ...