CVE-2008-3143: Integer Overflow
Description of problem:
Added checks for integer overflows, contributed by Google. Some are only available if asserts are left in the code, in cases where they can't be triggered from Python code.
Proposed upstream patch:
http://svn.python.org/view?rev=60793&view=rev
Other sources
Multiple integer overflows in Python before 2.5.2 might allow context-dependent attackers to have an unknown impact via vectors related to (1) Include/pymem.h; (2) csv.c, (3) struct.c, (4) arraymodule.c, (5) audioop.c, (6) binascii.c, (7) cPickle.c, (8) cStringIO.c, (9) cjkcodecs/multibytecodec.c, (10) datetimemodule.c, (11) md5.c, (12) rgbimgmodule.c, and (13) stropmodule.c in Modules/; (14) bufferobject.c, (15) listobject.c, and (16) obmalloc.c in Objects/; (17) Parser/node.c; and (18) asdl.c, (19) ast.c, (20) bltinmodule.c, and (21) compile.c in Python/, as addressed by "checks for integer overflows, contributed by Google."
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2008-3143?
CVE-2008-3143 has been classified as a moderate severity vulnerability due to potential integer overflow issues.
How do I fix CVE-2008-3143?
To mitigate CVE-2008-3143, upgrade to a patched version of Python above the specified vulnerable versions as indicated in security advisories.
Which versions of Python are affected by CVE-2008-3143?
CVE-2008-3143 affects Python versions including 1.5.2, 1.6.1, 2.0.1, 2.1.3, 2.2.3, 2.3.4 up to 2.3.7, 2.4.3 up to 2.4.5, and up to 2.5.1.
What are the potential impacts of CVE-2008-3143?
The potential impacts of CVE-2008-3143 include the risk of unexpected behavior or crashes in applications using the affected versions of Python.
Is there a patch for CVE-2008-3143?
Yes, there are proposed upstream patches available to fix CVE-2008-3143, which should be applied to the affected Python versions.