Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 7 Feb 2014 23:54:11 +0100
From: Raphael Geissert <>
Subject: CVE request? buffer overflow in socket.recvfrom_into


A bug has been reported in python, where socket.recvfrom_into "fails to 
check that the supplied buffer object is big enough for the requested read 
and so will happily write off the end"[1]. Ryan Smith-Roberts goes on to say 
"while very highly unlikely it's technically remotely exploitable".

Does anyone with a better python fu tell whether this should get a CVE id? A 
quick search on Debian's code doesn't really tell me much [2]

I've been able to reproduce the bug in python 2.5 and greater, which 
confirms what the bug report says.


Raphael Geissert - Debian Developer -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.