CVE-2010-2089

Published: 27 May 2010

The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-dependent attackers to cause a denial of service (memory corruption and application crash) via crafted arguments, as demonstrated by a call to audioop.reverse with a one-byte string, a different vulnerability than CVE-2010-1634.

Notes

Author	Note
mdeslaur	upstream bug report says 2.6 is affected also DoS only, setting to low

Priority

Status

Package	Release	Status
python2.4 Launchpad, Ubuntu, Debian	dapper	Ignored (reached end-of-life)
	hardy	Released (2.4.5-1ubuntu4.4)
	jaunty	Ignored (reached end-of-life)
	karmic	Ignored (reached end-of-life)
	lucid	Does not exist
	maverick	Does not exist
	natty	Does not exist
	oneiric	Does not exist
	precise	Does not exist
	quantal	Does not exist
	upstream	Needed
python2.5 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Released (2.5.2-2ubuntu6.2)
	jaunty	Ignored (reached end-of-life)
	karmic	Ignored (reached end-of-life)
	lucid	Does not exist
	maverick	Does not exist
	natty	Does not exist
	oneiric	Does not exist
	precise	Does not exist
	quantal	Does not exist
	upstream	Needed
python2.6 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	jaunty	Ignored (reached end-of-life)
	karmic	Ignored (reached end-of-life)
	lucid	Released (2.6.5-1ubuntu6.1)
	maverick	Not vulnerable (2.6.6-5ubuntu1)
	natty	Not vulnerable (2.6.6-5ubuntu1)
	oneiric	Not vulnerable (2.6.6-5ubuntu1)
	precise	Does not exist
	quantal	Does not exist
	upstream	Released (2.6.5+20100706-1)
	Patches: upstream: http://svn.python.org/view?view=rev&revision=82494 upstream: http://hg.python.org/cpython/rev/29116b2fcffe
python2.7 Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Does not exist
	natty	Not vulnerable
	oneiric	Not vulnerable
	precise	Not vulnerable
	quantal	Not vulnerable
	upstream	Released (2.7-1)
python3.1 Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Released (3.1.2-0ubuntu3.2)
	natty	Not vulnerable (3.1.3-1ubuntu1.1)
	oneiric	Does not exist
	precise	Does not exist
	quantal	Does not exist
	upstream	Released (3.1.3-1)
	Patches: upstream: http://hg.python.org/cpython/rev/7184421f83b5 (pt1) upstream: http://hg.python.org/cpython/rev/b67f720998a8 (pt2)
python3.2 Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Does not exist
	natty	Not vulnerable (3.2-1ubuntu1)
	oneiric	Not vulnerable
	precise	Not vulnerable
	quantal	Not vulnerable
	upstream	Released (3.2)

References

Bugs

http://bugs.python.org/issue7673

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Security