CVE-2017-1000158: Buffer Overflow
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyStringDecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python2.7to a version that resolves this vulnerability.Fixed in 2.7.16-2+deb10u1Fixed in 2.7.16-2+deb10u3Fixed in 2.7.18-8+deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000158?
CVE-2017-1000158 has a high severity rating due to the potential for a heap-based buffer overflow and arbitrary code execution.
How do I fix CVE-2017-1000158?
To fix CVE-2017-1000158, upgrade to Python versions 2.7.16 or higher.
What versions of Python are affected by CVE-2017-1000158?
Python versions up to 2.7.13, as well as certain versions from 3.4.0 to 3.4.8 and from 3.5.0 to 3.5.5, are affected by CVE-2017-1000158.
What impact does CVE-2017-1000158 have on my systems?
The impact of CVE-2017-1000158 includes possible arbitrary code execution due to an integer overflow vulnerability.
Is CVE-2017-1000158 exploitable remotely?
Yes, CVE-2017-1000158 is considered exploitable remotely if an attacker can send specially crafted input to the affected application.