The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-367:02 advisory.

    Python is an interpreted, interactive, object-oriented programming language often compared to Tcl, Perl,     Scheme or Java. Python includes modules, classes, exceptions, very high level dynamic data types and     dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various     windowing systems (X11, Motif, Tk, Mac and MFC).
    Programmers can write new built-in modules for Python in C or C++. Python can be used as an extension     language for applications that need a programmable interface. This package contains most of the standard     Python modules, as well as modules for interfacing to the Tix widget set for Tk and RPM.
    Note that documentation for Python is provided in the python-docs package.
    Fixed bugs:
    CVE-2007-2052     Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes     an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to     read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null     termination.
    CVE-2007-4965     Multiple integer overflows in the imageop module in Python 2.5.1 and earlier allow context-dependent     attackers to cause a denial of service (application crash) and possibly obtain sensitive information     (memory contents) via crafted arguments to (1) the tovideo method, and unspecified other vectors related     to (2) imageop.c, (3) rbgimgmodule.c, and other files, which trigger heap-based buffer overflows.
    CVE-2008-1721     Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers     to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and     a buffer overflow.
    CVE-2008-1887     Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors     that cause a negative size value to be provided to the PyString_FromStringAndSize function, which     allocates less memory than expected when assert() is disabled and triggers a buffer overflow.
    CVE-2008-2315     Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an     unknown impact via vectors related to the (1) stringobject, (2) unicodeobject, (3) bufferobject, (4)     longobject, (5) tupleobject, (6) stropmodule, (7) gcmodule, and (8) mmapmodule modules. NOTE: The     expandtabs integer overflows in stringobject and unicodeobject in 2.5.2 are covered by CVE-2008-5031.
    CVE-2008-3142     Multiple buffer overflows in Python 2.5.2 and earlier on 32bit platforms allow context-dependent attackers     to cause a denial of service (crash) or have unspecified other impact via a long string that leads to     incorrect memory allocation during Unicode string processing, related to the unicode_resize function and     the PyMem_RESIZE macro.
    CVE-2008-3143     Multiple integer overflows in Python before 2.5.2 might allow context-dependent attackers to have an     unknown impact via vectors related to (1) Include/pymem.h; (2) _csv.c, (3) _struct.c, (4) arraymodule.c,     (5) audioop.c, (6) binascii.c, (7) cPickle.c, (8) cStringIO.c, (9) cjkcodecs/multibytecodec.c, (10)     datetimemodule.c, (11) md5.c, (12) rgbimgmodule.c, and (13) stropmodule.c in Modules/; (14)     bufferobject.c, (15) listobject.c, and (16) obmalloc.c in Objects/; (17) Parser/node.c; and (18) asdl.c,     (19) ast.c, (20) bltinmodule.c, and (21) compile.c in Python/, as addressed by checks for integer     overflows, contributed by Google.
    CVE-2008-3144     Multiple integer overflows in the PyOS_vsnprintf function in Python/mysnprintf.c in Python 2.5.2 and     earlier allow context-dependent attackers to cause a denial of service (memory corruption) or have     unspecified other impact via crafted input to string formatting operations. NOTE: the handling of certain     integer values is also affected by related integer underflows and an off-by-one error.
    CVE-2008-4864     Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-     dependent attackers to break out of the Python VM and execute arbitrary code via large integer values in     certain arguments to the crop function, leading to a buffer overflow, a different vulnerability than     CVE-2007-4965 and CVE-2008-1679.
    CVE-2008-5031     Multiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to     have an unknown impact via a large integer value in the tabsize argument to the expandtabs method, as     implemented by (1) the string_expandtabs function in Objects/stringobject.c and (2) the unicode_expandtabs     function in Objects/unicodeobject.c. NOTE: this vulnerability reportedly exists because of an incomplete     fix for CVE-2008-2315.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1176 advisory.

    Python is an interpreted, interactive, object-oriented programming     language.

    When the assert() system call was disabled, an input sanitization flaw was     revealed in the Python string object implementation that led to a buffer     overflow. The missing check for negative size values meant the Python     memory allocator could allocate less memory than expected. This could     result in arbitrary code execution with the Python interpreter's     privileges. (CVE-2008-1887)

    Multiple buffer and integer overflow flaws were found in the Python Unicode     string processing and in the Python Unicode and string object     implementations. An attacker could use these flaws to cause a denial of     service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

    Multiple integer overflow flaws were found in the Python imageop module. If     a Python application used the imageop module to process untrusted images,     it could cause the application to disclose sensitive information, crash or,     potentially, execute arbitrary code with the Python interpreter's     privileges. (CVE-2007-4965, CVE-2008-4864)

    Multiple integer underflow and overflow flaws were found in the Python     snprintf() wrapper implementation. An attacker could use these flaws to     cause a denial of service (memory corruption). (CVE-2008-3144)

    Multiple integer overflow flaws were found in various Python modules. An     attacker could use these flaws to cause a denial of service (Python     application crash). (CVE-2008-2315, CVE-2008-3143)

    An integer signedness error, leading to a buffer overflow, was found     in the Python zlib extension module. If a Python application requested     the negative byte count be flushed for a decompression stream, it could     cause the application to crash or, potentially, execute arbitrary code     with the Python interpreter's privileges. (CVE-2008-1721)

    A flaw was discovered in the strxfrm() function of the Python locale     module. Strings generated by this function were not properly     NULL-terminated, which could possibly cause disclosure of data stored in     the memory of a Python application using this function. (CVE-2007-2052)

    Red Hat would like to thank David Remahl of the Apple Product Security team     for responsibly reporting the CVE-2008-2315 issue.

    All Python users should upgrade to these updated packages, which contain     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated python packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Python is an interpreted, interactive, object-oriented programming language.

When the assert() system call was disabled, an input sanitization flaw was revealed in the Python string object implementation that led to a buffer overflow. The missing check for negative size values meant the Python memory allocator could allocate less memory than expected. This could result in arbitrary code execution with the Python interpreter's privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode string processing and in the Python Unicode and string object implementations. An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If a Python application used the imageop module to process untrusted images, it could cause the application to disclose sensitive information, crash or, potentially, execute arbitrary code with the Python interpreter's privileges. (CVE-2007-4965, CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python snprintf() wrapper implementation. An attacker could use these flaws to cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules.
An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-2315, CVE-2008-3143)

An integer signedness error, leading to a buffer overflow, was found in the Python zlib extension module. If a Python application requested the negative byte count be flushed for a decompression stream, it could cause the application to crash or, potentially, execute arbitrary code with the Python interpreter's privileges.
(CVE-2008-1721)

A flaw was discovered in the strxfrm() function of the Python locale module. Strings generated by this function were not properly NULL-terminated, which could possibly cause disclosure of data stored in the memory of a Python application using this function.
(CVE-2007-2052)

Red Hat would like to thank David Remahl of the Apple Product Security team for responsibly reporting the CVE-2008-2315 issue.

All Python users should upgrade to these updated packages, which contain backported patches to correct these issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
284392	MiracleLinux 3 : python-2.4.3-24.6.1AXS3 (AXSA:2009-367:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
40400	RHEL 5 : python (RHSA-2009:1176)	Nessus	Red Hat Local Security Checks	2009/7/28	2024/11/4	critical
43771	CentOS 5 : python (CESA-2009:1176)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	critical

偵測

搜尋 Plugin

critical

critical

critical