CVE-2007-4965

CVSS V2 Medium 5.8 CVSS V3 None
Description
Multiple integer overflows in the imageop module in Python 2.5.1 and earlier allow context-dependent attackers to cause a denial of service (application crash) and possibly obtain sensitive information (memory contents) via crafted arguments to (1) the tovideo method, and unspecified other vectors related to (2) imageop.c, (3) rbgimgmodule.c, and other files, which trigger heap-based buffer overflows.
Overview
  • CVE ID
  • CVE-2007-4965
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2007-09-18T22:17:00
  • Last Modified Date
  • 2018-10-15T21:39:00
Weakness Enumerations
CWE URL
CWE-189 http://cwe.mitre.org/data/definitions/189.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:python_software_foundation:python:1.5.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:1.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:1.6.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.1.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.1.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.2.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.2.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.3.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.3.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.3.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.3.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.3.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.3.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.4.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.4.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.4.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.4.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:python_software_foundation:python:2.5.1:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:P/I:N/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 5.8
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 4.9
References
Reference URL Reference Tags
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065826.html Exploit
http://www.securityfocus.com/bid/25696 Exploit
http://bugs.gentoo.org/show_bug.cgi?id=192876
https://issues.rpath.com/browse/RPL-1885
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00378.html
http://www.gentoo.org/security/en/glsa/glsa-200711-07.xml
http://www.redhat.com/support/errata/RHSA-2007-1076.html
http://secunia.com/advisories/26837
http://secunia.com/advisories/27460
http://secunia.com/advisories/27562
http://secunia.com/advisories/27872
http://docs.info.apple.com/article.html?artnum=307179
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
http://www.us-cert.gov/cas/techalerts/TA07-352A.html US Government Resource
http://secunia.com/advisories/28136
http://www.mandriva.com/security/advisories?name=MDVSA-2008:012
http://www.mandriva.com/security/advisories?name=MDVSA-2008:013
http://secunia.com/advisories/28480
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
http://secunia.com/advisories/28838
http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0254
http://lists.vmware.com/pipermail/security-announce/2008/000005.html
http://secunia.com/advisories/29032
http://www.ubuntu.com/usn/usn-585-1
http://secunia.com/advisories/29303
http://www.debian.org/security/2008/dsa-1551
http://secunia.com/advisories/29889
http://www.debian.org/security/2008/dsa-1620
http://secunia.com/advisories/31255
http://secunia.com/advisories/31492
http://www.redhat.com/support/errata/RHSA-2008-0629.html
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
http://secunia.com/advisories/33937
http://support.apple.com/kb/HT3438
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/3316
http://secunia.com/advisories/37471
http://support.avaya.com/css/P8/documents/100074697
http://secunia.com/advisories/38675
http://www.vupen.com/english/advisories/2007/4238
http://www.vupen.com/english/advisories/2008/0637
http://www.vupen.com/english/advisories/2007/3201
https://exchange.xforce.ibmcloud.com/vulnerabilities/36653
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8496
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8486
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10804
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/archive/1/488457/100/0/threaded
http://www.securityfocus.com/archive/1/487990/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2007-4965
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4965
History
Created Old Value New Value Data Type Notes
2022-05-10 18:20:32 Added to TrackCVE