Description
Multiple integer overflows in the imageop module in Python 2.5.1 and earlier allow context-dependent attackers to cause a denial of service (application crash) and possibly obtain sensitive information (memory contents) via crafted arguments to (1) the tovideo method, and unspecified other vectors related to (2) imageop.c, (3) rbgimgmodule.c, and other files, which trigger heap-based buffer overflows.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | python2.4 | 2.4.4-3+etch1 | DSA-1551-1 |
| Debian 4.0 | python2.5 | 2.5-5+etch1 | DSA-1620-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | python +3 | 2.4.3-24.el5_3.6 | RHSA-2009:1176 |
| RHEL 4 | python +4 | 2.3.4-14.4.el4_6.1 | RHSA-2007:1076 |
| RHEL 3 | python +3 | 2.2.3-6.8 | RHSA-2007:1076 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | rhn-solaris-bootstrap | 5.0.2-3 | RHSA-2008:0629, RHSA-2008:0264 |
| Red Hat Network Satellite 5 | rhn_solaris_bootstrap_5_0_2_3 +1 | 1-0 | RHSA-2008:0629, RHSA-2008:0264 |
| Red Hat Network Satellite 4 | rhn-solaris-bootstrap | 5.0.2-3 | RHSA-2008:0525 |
| Red Hat Network Satellite 4 | rhn_solaris_bootstrap_5_0_2_3 | 1-0 | RHSA-2008:0525 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Python 2.2 ImageOP Module - Multiple Integer Overflow Vulnerabilities EDB-30592 · dos · Sep 17, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2009:1176 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1076 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1551-1 python2.4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1620-1 python2.5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2008:0629 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0525 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0264 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- [Security-announce] 20080221 VMSA-2008-0003 Moderate: Updated aacraid driver and samba and python service console updates mailing-list
- 25696 vdb-entry
- http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0254
- ADV-2007-4238 vdb-entry
- 38675 third-party-advisory
- TA07-352A third-party-advisory
- oval:org.mitre.oval:def:8496 vdb-entry signature
- 33937 third-party-advisory
- 28136 third-party-advisory
- 37471 third-party-advisory
- 27460 third-party-advisory
- 28480 third-party-advisory
- 26837 third-party-advisory
- ADV-2007-3201 vdb-entry
- DSA-1551 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 29303 third-party-advisory
- oval:org.mitre.oval:def:8486 vdb-entry signature
- http://support.apple.com/kb/HT3438
- APPLE-SA-2009-02-12 vendor-advisory
- 27872 third-party-advisory
- 29032 third-party-advisory
- 31492 third-party-advisory
- FEDORA-2007-2663 vendor-advisory
- oval:org.mitre.oval:def:10804 vdb-entry signature
- RHSA-2008:0629 vendor-advisory
- 20070916 python <= 2.5.1 standart librairy multiples int overflow, heap overflow in imageop module mailing-list
- 20080221 VMSA-2008-0003 Moderate: Updated aacraid driver and samba and python service console updates mailing-list
- APPLE-SA-2007-12-17 vendor-advisory
- RHSA-2007:1076 vendor-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- ADV-2008-0637 vdb-entry
- python-imageop-bo(36653) vdb-entry
- http://bugs.gentoo.org/show_bug.cgi?id=192876
- http://docs.info.apple.com/article.html?artnum=307179
- 27562 third-party-advisory
- USN-585-1 vendor-advisory
- GLSA-200711-07 vendor-advisory
- MDVSA-2008:012 vendor-advisory
- http://support.avaya.com/css/P8/documents/100074697
- 31255 third-party-advisory
- 20080212 FLEA-2008-0002-1 python mailing-list
- MDVSA-2008:013 vendor-advisory
- DSA-1620 vendor-advisory
- 28838 third-party-advisory
- SUSE-SR:2008:003 vendor-advisory
- https://issues.rpath.com/browse/RPL-1885
- ADV-2009-3316 vdb-entry
- 29889 third-party-advisory