Skip to content
OpenAdvisories
Medium ELSA-2015-1064 6 CVEs

Moderate: python27 security, bug fix, and enhancement update (Oracle Linux 7)

Published Feb 4, 2016 · Updated Feb 4, 2016

Ecosystem: Oracle Linux

Summary

python27
[1.1-17]
- Require python-pip and python-wheel (note: in rh-python34
this is not necessary, because 'python' depends on these).

python27-python
[2.7.8-3]
- Add httplib fix for CVE-2013-1752
Resolves: rhbz#1187779

[2.7.8-2]
- Fix %check
unset DISPLAY
setion not failing properly on failed test
- Fixed CVE-2013-1752, CVE-2013-1753
Resolves: rhbz#1187779

[2.7.8-1]
- Update to 2.7.8.
Resolves: rhbz#1167912
- Make python-devel depend on scl-utils-build.
Resolves: rhbz#1170993

python27-python-pip
- New Package added

python27-python-setuptools
[0.9.8-3]
- Enhance patch restoring proxy support in SSL connections
Resolves: rhbz#1222507

python27-python-simplejson
[3.2.0-2]
- Fix CVE-2014-461, add boundary checks
Resolves: rhbz#1222534

python27-python-wheel
- New Package added

Fixed packages 14

ReleasePackageFixed in
Oracle Linux · 7 python27 0:1.1-20.el7
Oracle Linux · 7 python27-python 0:2.7.8-3.el7
Oracle Linux · 7 python27-python-debug 0:2.7.8-3.el7
Oracle Linux · 7 python27-python-devel 0:2.7.8-3.el7
Oracle Linux · 7 python27-python-libs 0:2.7.8-3.el7
Oracle Linux · 7 python27-python-pip 0:1.5.6-5.el7
Oracle Linux · 7 python27-python-setuptools 0:0.9.8-5.el7
Oracle Linux · 7 python27-python-simplejson 0:3.2.0-3.el7
Oracle Linux · 7 python27-python-test 0:2.7.8-3.el7
Oracle Linux · 7 python27-python-tools 0:2.7.8-3.el7
Oracle Linux · 7 python27-python-wheel 0:0.24.0-2.el7
Oracle Linux · 7 python27-runtime 0:1.1-20.el7
Oracle Linux · 7 python27-scldevel 0:1.1-20.el7
Oracle Linux · 7 python27-tkinter 0:2.7.8-3.el7

Vulnerabilities 6

  • Medium 5.9
    CVE-2014-4616

    simplejson before 2.6.1 vulnerable to array index error

    Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode functio…

    python3.4 python2.7 python2.7 python2 Debian Ubuntu Alpine PyPI
  • Unscored —
    CVE-2013-1752 Rejected

    Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of …

    python2.7 Ubuntu
  • Unscored —
    CVE-2013-1753

    The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a deni…

    python3.4 python2.7 python2.7 Debian Ubuntu
  • Unscored —
    CVE-2014-1912 Public exploit EPSS 27%

    Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3…

    python2.7 Debian
  • Unscored —
    CVE-2014-4650 Public exploit EPSS 24%

    The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path…

    python3.4 python2.7 python2.7 Debian Ubuntu
  • Unscored —
    CVE-2014-7185

    Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive inform…

    python2.7 python-py python2.7 Debian Ubuntu Azure Linux