Description
Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Python VM and execute arbitrary code via large integer values in certain arguments to the crop function, leading to a buffer overflow, a different vulnerability than CVE-2007-4965 and CVE-2008-1679.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | python +3 | 2.4.3-24.el5_3.6 | RHSA-2009:1176 |
| RHEL 4 | python +4 | 2.3.4-14.7.el4_8.2 | RHSA-2009:1177 |
| RHEL 3 | python +3 | 2.2.3-6.11 | RHSA-2009:1178 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Python < 2.5.2 Imageop Module - 'imageop.crop()' Buffer Overflow EDB-10229 · dos · Nov 24, 2009 · verified
- Python 2.5.2 - 'Imageop' Module Argument Validation Buffer Overflow EDB-32534 · dos · Oct 27, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2009:1176 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1178 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1177 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://svn.python.org/view/python/trunk/Modules/imageop.c?rev=66689&view=diff&r1=66689&r2=66688&p1=python/trunk/Modules/imageop.c&p2=/python/trunk/Modules/imageop.c
- oval:org.mitre.oval:def:10702 vdb-entry signature
- 33937 third-party-advisory
- oval:org.mitre.oval:def:8354 vdb-entry signature
- http://scary.beasts.org/security/CESA-2008-008.html
- python-image-module-bo(46606) vdb-entry
- 37471 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://support.apple.com/kb/HT3438
- APPLE-SA-2009-02-12 vendor-advisory
- http://svn.python.org/view?rev=66689&view=rev
- 31976 vdb-entry
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 31932 vdb-entry
- [oss-security] 20081027 CVE request -- Python imageop#3 mailing-list
- [oss-security] 20081029 CVE Request - Python imageop mailing-list
- ADV-2009-3316 vdb-entry