Browse CVEs

MEDIUM 6.1 CVE-2016-5699EPSS 10% CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.… Python after 2.7.9 Fix from $1,6002016-09-02 CRITICAL 9.8 CVE-2016-5636EPSS 25% Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remot… Python Patch available Fix from $2,3002016-09-02 MEDIUM 6.5 CVE-2016-0772EPSS 15% The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, whi… Python Patch available Fix from $1,6002016-09-02 MEDIUM 6.5 CVE-2016-3189EPSS 16% Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, re… Python 3.7.13 / 3.8.13+ Fix from $1,6002016-06-30 MEDIUM 5.9 CVE-2013-7440 The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which migh… Python after 2.7.8 Fix from $1,6002016-06-07 CRITICAL 9.8 CVE-2016-4009EPSS 8% Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecifie… Pillow after 3.1.0 Fix from $2,3002016-04-13 MEDIUM 6.5 CVE-2016-2533 Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remo… Pillow after 3.1.0 Fix from $1,6002016-04-13 MEDIUM 6.5 CVE-2016-0775 Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of servic… Pillow after 3.1.0 Fix from $1,6002016-04-13 MEDIUM 6.5 CVE-2016-0740 Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory vi… Pillow after 3.1.0 Fix from $1,6002016-04-13 MEDIUM 5.3 CVE-2016-1494EPSS 7% The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via craft… Rsa 3.3+ Fix from $1,6002016-01-13 HIGH 7.2 CVE-2015-5652 Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readlin… Python after 3.5.0 Fix from $1,9502015-10-06 MEDIUM 5.0 CVE-2014-3598 The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image. Pillow after 2.5.2 Fix from $1,6002015-05-01 MEDIUM 6.8 CVE-2015-2296 The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cooki… Requests Patch available Fix from $1,6002015-03-18 MEDIUM 5.0 CVE-2014-9601 Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is … Pillow after 2.6.2 Fix from $1,6002015-01-16 MEDIUM 5.8 CVE-2014-9365 The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4… Python after 10.10.4 Fix from $1,6002014-12-12 MEDIUM 5.0 CVE-2014-1830 Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redi… Requests after 2.2.1 Fix from $1,6002014-10-15 MEDIUM 6.4 CVE-2014-7185EPSS 5% Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via … Python after 10.10.4 Fix from $1,6002014-10-08 HIGH 10.0 CVE-2014-3007EPSS 12% Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in un… Pillow after 1.1.7 Fix from $1,9502014-04-27 HIGH 7.1 CVE-2013-7338EPSS 5% Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than th… Python after 10.10.4 Fix from $1,9502014-04-22 HIGH 7.5 CVE-2014-1912EPSS 28% Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 … Python after 10.10.4 Fix from $1,9502014-03-01 MEDIUM 6.8 CVE-2013-0340EPSS 19% expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, wh… Python 2.4.0 / 3.6.15+ Fix from $1,6002014-01-21 MEDIUM 6.8 CVE-2013-1633 easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package conte… Setuptools after 0.7b4 Fix from $1,6002013-08-06 MEDIUM 6.4 CVE-2012-2135 The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, wh… Python 2.7.4 / 3.2.4+ Fix from $1,6002012-08-14 MEDIUM 5.0 CVE-2010-3492 The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documenta… Python 3.1.2+ Fix from $1,6002010-10-19 MEDIUM 5.0 CVE-2010-1634 Multiple integer overflows in audioop.c in the audioop module in Python 2.6, 2.7, 3.1, and 3.2 allow context-dependent attackers to cause a denial of… Python 2.5.6 / 2.6.6+ Fix from $1,6002010-05-27 MEDIUM 5.0 CVE-2010-2089EPSS 15% The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-depen… Python 2.5.6 / 2.6.6+ Fix from $1,6002010-05-27 MEDIUM 6.9 CVE-2008-5983 Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty strin… Python 2.6.6 / 3.1.3+ Fix from $1,6002009-01-28 CRITICAL 9.8 CVE-2007-4559EPSS 27% Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attacke… Python 3.6.16 / 3.8.17+ Fix from $2,3002007-08-28