CVE-2016-5636

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

• CVE-2016-5636: fix heap-based buffer overflow in zipimport.c

• CVE-2016-5636: fix heap-based buffer overflow in zipimport.c

Updated python and python3 packages fixes security vulnerability:

• Heap overflow in zipimporter module (CVE-2016-5636).
• HTTP header injection in urrlib2/urllib/httplib/http.client (CVE-2016-5699).
• smtplib StartTLS stripping attack (CVE-2016-0772).

This update for python3 to version 3.6.10 fixes the following issues:

• CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
• CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
• CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the python-doc-2.7.12-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-2.7.12-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libpython2_7-1_0-2.7.12-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed.

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

This update for python fixes the following issues:

• CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack (bsc#984751)
• CVE-2016-5636: heap overflow when importing malformed zip files (bsc#985177)
• CVE-2016-5699: incorrect validation of HTTP headers allow header injection (bsc#985348)
• CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY when REQUEST_METHOD is also set (bsc#989523)

This update provides Python 3.4.5, which brings many fixes and enhancements.

The following security issues have been fixed:

• CVE-2016-1000110: CGIHandler could have allowed setting of HTTP_PROXY environment variable based on user supplied Proxy request header. (bsc#989523)
• CVE-2016-0772: A vulnerability in smtplib could have allowed a MITM attacker to perform a startTLS stripping attack. (bsc#984751)
• CVE-2016-5636: A heap overflow in Python's zipimport module. (bsc#985177)
• CVE-2016-5699: A header injection flaw in urrlib2/urllib/httplib/http.client. (bsc#985348)

The update also includes the following non-security fixes:

• Don't force 3rd party C extensions to be built with -Werror=declaration-after-statement. (bsc#951166)
• Make urllib proxy var handling behave as usual on POSIX. (bsc#983582)

For a comprehensive list of changes please refer to the upstream change log: https://docs.python.org/3.4/whatsnew/changelog.html

This update provides Python 3.4.5, which brings many fixes and enhancements.

The following security issues have been fixed:

• CVE-2016-1000110: CGIHandler could have allowed setting of HTTP_PROXY environment variable based on user supplied Proxy request header. (bsc#989523)
• CVE-2016-0772: A vulnerability in smtplib could have allowed a MITM attacker to perform a startTLS stripping attack. (bsc#984751)
• CVE-2016-5636: A heap overflow in Python's zipimport module. (bsc#985177)
• CVE-2016-5699: A header injection flaw in urrlib2/urllib/httplib/http.client. (bsc#985348)

The update also includes the following non-security fixes:

• Don't force 3rd party C extensions to be built with -Werror=declaration-after-statement. (bsc#951166)
• Make urllib proxy var handling behave as usual on POSIX. (bsc#983582)

For a comprehensive list of changes please refer to the upstream change log: https://docs.python.org/3.4/whatsnew/changelog.html

This update for python-base fixes the following issues:

Security issues fixed:

• CVE-2018-1061: Fixed DoS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib (bsc#1088004).
• CVE-2018-1060: Fixed DoS via regular expression catastrophic backtracking in apop() method in pop3lib (bsc#1088009).
• CVE-2016-5636: Fixed heap overflow in zipimporter module (bsc#985177)

Bug fixes:

• bsc#1086001: python tarfile uses random order.

This update for python fixes the following issues:

Security issues fixed:

• CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack (bsc#984751)
• CVE-2016-5636: heap overflow when importing malformed zip files (bsc#985177)
• CVE-2016-5699: incorrect validation of HTTP headers allow header injection (bsc#985348)
• CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY when REQUEST_METHOD is also set (bsc#989523)
• CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191)

This update for python3 to version 3.6.10 fixes the following issues:

• CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
• CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
• CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

This update for python fixes the following issues:

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

It was discovered that the smtplib library in Python did not return an error when StartTLS fails. A remote attacker could possibly use this to expose sensitive information. (CVE-2016-0772)

Rémi Rampin discovered that Python would not protect CGI applications from contents of the HTTP_PROXY environment variable when based on the contents of the Proxy header from HTTP requests. A remote attacker could possibly use this to cause a CGI application to redirect outgoing HTTP requests. (CVE-2016-1000110)

Insu Yun discovered an integer overflow in the zipimporter module in Python that could lead to a heap-based overflow. An attacker could use this to craft a special zip file that when read by Python could possibly execute arbitrary code. (CVE-2016-5636)

Guido Vranken discovered that the urllib modules in Python did not properly handle carriage return line feed (CRLF) in headers. A remote attacker could use this to craft URLs that inject arbitrary HTTP headers. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5699)