RHSA-2011:0027: Low: python security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programminglanguage.It was found that many applications embedding the Python interpreter didnot specify a valid full path to the script or application when calling thePySysSetArgv API function, which could result in the addition of thecurrent working directory to the module search path (sys.path). A localattacker able to trick a victim into running such an application in anattacker-controlled directory could use this flaw to execute code with thevictim's privileges. This update adds the PySysSetArgvEx API. Developerscan modify their applications to use this new API, which sets sys.argvwithout modifying sys.path. (CVE-2008-5983)Multiple flaws were found in the Python rgbimg module. If an applicationwritten in Python was using the rgbimg module and loaded aspecially-crafted SGI image file, it could cause the application to crashor, possibly, execute arbitrary code with the privileges of the userrunning the application. (CVE-2009-4134, CVE-2010-1449, CVE-2010-1450)Multiple flaws were found in the Python audioop module. Supplying certaininputs could cause the audioop module to crash or, possibly, executearbitrary code. (CVE-2010-1634, CVE-2010-2089)This update also fixes the following bugs: When starting a child process from the subprocess module in Python 2.4, the parent process could leak file descriptors if an error occurred. Thisupdate resolves the issue. (BZ#609017) Prior to Python 2.7, programs that used "ulimit -n" to enable communication with large numbers of subprocesses could still monitor only1024 file descriptors at a time, which caused an exception:ValueError: filedescriptor out of range in select()This was due to the subprocess module using the "select" system call. Themodule now uses the "poll" system call, removing this limitation.(BZ#609020) Prior to Python 2.5, the tarfile module failed to unpack tar files if the path was longer than 100 characters. This update backports the tarfilemodule from Python 2.5 and the issue no longer occurs. (BZ#263401) The email module incorrectly implemented the logic for obtaining attachment file names: the getfilename() fallback for using the deprecated"name" parameter of the "Content-Type" header erroneously used the"Content-Disposition" header. This update backports a fix from Python 2.6,which resolves this issue. (BZ#644147) Prior to version 2.5, Python's optimized memory allocator never released memory back to the system. The memory usage of a long-running Pythonprocess would resemble a "high-water mark". This update backports a fixfrom Python 2.5a1, which frees unused arenas, and adds a non-standardsys.debugmallocstats() function, which prints diagnostic information tostderr. Finally, when running under Valgrind, the optimized allocator isdeactivated, to allow more convenient debugging of Python memory usageissues. (BZ#569093) The urllib and urllib2 modules ignored the noproxy variable, which could lead to programs such as "yum" erroneously accessing a proxy server forURLs covered by a "noproxy" exclusion. This update backports fixes ofurllib and urllib2, which respect the "noproxy" variable, which fixesthese issues. (BZ#549372)As well, this update adds the following enhancements: This update introduces a new python-libs package, subsuming the majority of the content of the core python package. This makes both 32-bit and64-bit Python libraries available on PowerPC systems. (BZ#625372) The python-libs.i386 package is now available for 64-bit Itanium with the 32-bit Itanium compatibility mode. (BZ#644761)All Python users are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues and add theseenhancements.