Description of problem:

A security flaw was discovered in the Python generic FAQ wizard moving tool (move-faqwiz.sh).

Relevant part of the code:

28 cutnpad $1 2 suffix1 29 cutnpad $2 1 prefix2 30 cutnpad $2 2 suffix2 31 tmpfile=tmp$RANDOM.tmp 32 file1=faq$prefix1.$suffix1.htp 33 file2=faq$prefix2.$suffix2.htp

Description:

An attacker could in advance create a symbolic link pointing to tmpXXXXX.tmp (the output produced by $RANDOM is only 5 digits long), then run the Python generic FAQ wizard moving tool which would allow him to erase / truncate the target of the symbolic link to zero size.

References:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498899

Multiple integer overflows in the PyOSvsnprintf function in Python/mysnprintf.c in Python 2.5.2 and earlier allow context-dependent attackers to cause a denial of service (memory corruption) or have unspecified other impact via crafted input to string formatting operations. NOTE: the handling of certain integer values is also affected by related integer underflows and an off-by-one error.

Description of problem:

Added checks for integer overflows, contributed by Google. Some are only available if asserts are left in the code, in cases where they can't be triggered from Python code.

Proposed upstream patch:

http://svn.python.org/view?rev=60793&view=rev

Integer overflow in hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the (1) stringobject, (2) unicodeobject, (3) bufferobject, (4) longobject, (5) tupleobject, (6) stropmodule, (7) gcmodule, and (8) mmapmodule modules. NOTE: The expandtabs integer overflows in stringobject and unicodeobject in 2.5.2 are covered by CVE-2008-5031.