Fluid Attacks Database

Description

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	python2.7	>=0 <2.7.12~rc1-1	2.7.12~rc1-1
rpm rhel5	python	-	-
rpm rhel6	python	-	-
rpm rhel7	python	<0:2.7.5-48.el7	0:2.7.5-48.el7
pypi	python	>=0 <=2.7.11 \|\| >=3.0 <=3.0 \|\| >=3.0.1 <=3.0.1 \|\| >=3.1.1 <=3.1.1 \|\| >=3.1.2 <=3.1.2 \|\| >=3.1.3 <=3.1.3 \|\| >=3.1.4 <=3.1.4 \|\| >=3.1.5 <=3.1.5 \|\| >=3.2.1 <=3.2.1 \|\| >=3.2.2 <=3.2.2 \|\| >=3.2.3 <=3.2.3 \|\| >=3.2.4 <=3.2.4 \|\| >=3.2.5 <=3.2.5 \|\| >=3.2.6 <=3.2.6 \|\| >=3.3.0 <=3.3.0 \|\| >=3.3.1 <=3.3.1 \|\| >=3.3.2 <=3.3.2 \|\| >=3.3.3 <=3.3.3 \|\| >=3.3.4 <=3.3.4 \|\| >=3.3.5 <=3.3.5 \|\| >=3.3.6 <=3.3.6 \|\| >=3.4.0 <=3.4.0 \|\| >=3.4.1 <=3.4.1 \|\| >=3.4.2 <=3.4.2 \|\| >=3.4.3 <=3.4.3 \|\| >=3.4.4 <=3.4.4 \|\| >=3.5.0 <=3.5.0 \|\| >=3.5.1 <=3.5.1	-

Aliases

1. CVE-2016-56362. NVD-2016-56363. OSV-DEBIAN-2016-56364. OSV-2016-56365. GCVE-2016-56366. SECURITY-TRACKER-CVE-2016-56367. lists.debian.org8. rhn.redhat.com9. docs.python.org10. docs.python.org11. hg.python.org12. security.gentoo.org

References

1. https://github.com/insuyun/CVE-2016-56362. http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html3. http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html4. http://www.securityfocus.com/bid/912475. http://www.securitytracker.com/id/10381386. http://www.splunk.com/view/SP-CAAAPSV7. http://www.splunk.com/view/SP-CAAAPUE8. https://bugs.python.org/issue261719. http://www.openwall.com/lists/oss-security/2016/06/15/1510. http://www.openwall.com/lists/oss-security/2016/06/16/1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.