CVE-2016-5636

Published: 02 September 2016

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
python2.7
Launchpad, Ubuntu, Debian
Upstream
Released (2.7.12~rc1-1)
Ubuntu 21.10 (Impish Indri) Not vulnerable
(2.7.12-3)
Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(2.7.12-3)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(2.7.12-3)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(2.7.12-3)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (2.7.12-1ubuntu0~16.04.1)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (2.7.6-8ubuntu0.3)
Patches:
Upstream: https://hg.python.org/cpython/rev/985fc64c60d6
Upstream: https://hg.python.org/cpython/rev/2edbdb79cd6d
python3.2
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 21.10 (Impish Indri) Does not exist

Ubuntu 21.04 (Hirsute Hippo) Does not exist

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

python3.4
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 21.10 (Impish Indri) Does not exist

Ubuntu 21.04 (Hirsute Hippo) Does not exist

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr)
Released (3.4.3-1ubuntu1~14.04.5)
Patches:
Upstream: https://hg.python.org/cpython/rev/01ddd608b85c
Upstream: https://hg.python.org/cpython/rev/8b58c9328f5c
python3.5
Launchpad, Ubuntu, Debian
Upstream
Released (3.5.2~rc1-1)
Ubuntu 21.10 (Impish Indri) Does not exist

Ubuntu 21.04 (Hirsute Hippo) Does not exist

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus)
Released (3.5.2-2ubuntu0~16.04.1)
Ubuntu 14.04 ESM (Trusty Tahr) Needs triage

Patches:
Upstream: https://hg.python.org/cpython/rev/10dad6da1b28

Notes

AuthorNote
sbeattie
issue is fixed for xenial/python3.5 and xenial/python2.7
for packages in xenial-updates, but not xenial-security
may also need https://hg.python.org/cpython/rev/2edbdb79cd6d
(see comment on python bug above) for pre-2.7.8 code and possibly 3.x
code.

References