Description
Multiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large integer value in the tabsize argument to the expandtabs method, as implemented by (1) the string_expandtabs function in Objects/stringobject.c and (2) the unicode_expandtabs function in Objects/unicodeobject.c. NOTE: this vulnerability reportedly exists because of an incomplete fix for CVE-2008-2315.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | python +3 | 2.4.3-24.el5_3.6 | RHSA-2009:1176 |
| RHEL 4 | python +4 | 2.3.4-14.7.el4_8.2 | RHSA-2009:1177 |
| RHEL 3 | python +3 | 2.2.3-6.11 | RHSA-2009:1178 |
Advisories 3
- RHSA-2009:1176 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1178 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1177 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://svn.python.org/view/python/trunk/Objects/unicodeobject.c?rev=61350&view=diff&r1=61350&r2=61349&p1=python/trunk/Objects/unicodeobject.c&p2=/python/trunk/Objects/unicodeobject.c
- GLSA-200907-16 vendor-advisory
- 33937 third-party-advisory
- http://scary.beasts.org/security/CESA-2008-008.html
- 37471 third-party-advisory
- [oss-security] 20081105 Re: CVE Request - Python string expandtabs mailing-list
- [oss-security] 20081105 CVE Request - Python string expandtabs mailing-list
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://support.apple.com/kb/HT3438
- http://svn.python.org/view?rev=61350&view=rev
- APPLE-SA-2009-02-12 vendor-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- python-expandtabs-integer-overflow(46612) vdb-entry
- oval:org.mitre.oval:def:8564 vdb-entry signature
- 35750 third-party-advisory
- oval:org.mitre.oval:def:11280 vdb-entry signature
- http://svn.python.org/view/python/trunk/Objects/stringobject.c?rev=61350&view=diff&r1=61350&r2=61349&p1=python/trunk/Objects/stringobject.c&p2=/python/trunk/Objects/stringobject.c
- ADV-2009-3316 vdb-entry