ALT-PU-2017-2343-1
Closed vulnerabilities
Published: 2016-09-02
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-0772
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
Severity: MEDIUM (6.5)
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
References:
- openSUSE-SU-2020:0086
- openSUSE-SU-2020:0086
- RHSA-2016:1626
- RHSA-2016:1626
- RHSA-2016:1627
- RHSA-2016:1627
- RHSA-2016:1628
- RHSA-2016:1628
- RHSA-2016:1629
- RHSA-2016:1629
- RHSA-2016:1630
- RHSA-2016:1630
- [oss-security] 20160614 Python CVE-2016-0772: smtplib StartTLS stripping attack
- [oss-security] 20160614 Python CVE-2016-0772: smtplib StartTLS stripping attack
- 91225
- 91225
- http://www.splunk.com/view/SP-CAAAPSV
- http://www.splunk.com/view/SP-CAAAPSV
- http://www.splunk.com/view/SP-CAAAPUE
- http://www.splunk.com/view/SP-CAAAPUE
- https://bugzilla.redhat.com/show_bug.cgi?id=1303647
- https://bugzilla.redhat.com/show_bug.cgi?id=1303647
- https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5
- https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5
- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2
- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2
- https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS
- https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS
- https://hg.python.org/cpython/rev/b3ce713fb9be
- https://hg.python.org/cpython/rev/b3ce713fb9be
- https://hg.python.org/cpython/rev/d590114c2394
- https://hg.python.org/cpython/rev/d590114c2394
- [debian-lts-announce] 20190207 [SECURITY] [DLA 1663-1] python3.4 security update
- [debian-lts-announce] 20190207 [SECURITY] [DLA 1663-1] python3.4 security update
- GLSA-201701-18
- GLSA-201701-18
Published: 2016-09-02
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-5636
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
Severity: CRITICAL (9.8)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- openSUSE-SU-2020:0086
- openSUSE-SU-2020:0086
- RHSA-2016:2586
- RHSA-2016:2586
- [oss-security] 20160615 CVE Request: heap overflow in Python zipimport module
- [oss-security] 20160615 CVE Request: heap overflow in Python zipimport module
- [oss-security] 20160616 Re: CVE Request: heap overflow in Python zipimport module
- [oss-security] 20160616 Re: CVE Request: heap overflow in Python zipimport module
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- 91247
- 91247
- 1038138
- 1038138
- http://www.splunk.com/view/SP-CAAAPSV
- http://www.splunk.com/view/SP-CAAAPSV
- http://www.splunk.com/view/SP-CAAAPUE
- http://www.splunk.com/view/SP-CAAAPUE
- https://bugs.python.org/issue26171
- https://bugs.python.org/issue26171
- https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5
- https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5
- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2
- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2
- https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS
- https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS
- [debian-lts-announce] 20190207 [SECURITY] [DLA 1663-1] python3.4 security update
- [debian-lts-announce] 20190207 [SECURITY] [DLA 1663-1] python3.4 security update
- GLSA-201701-18
- GLSA-201701-18
Closed bugs
После пересборки: OSError: [Errno 38] Function not implemented