CVE-2014-1858: numpy Improper Input Validation

EPSS trend

Probability

0.45%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

0.00 pp

From 0.45% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.45%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

16 links

lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.htmlVendor AdvisoryX Refsource FEDORAThird Party AdvisoryWEB
github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15X Refsource CONFIRMThird Party AdvisoryWEBFIX
bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778X Refsource CONFIRMMailing ListThird Party AdvisoryWEB
github.com/numpy/numpy/pull/4262X Refsource CONFIRMThird Party AdvisoryWEB
bugzilla.redhat.com/show_bug.cgi?id=1062009X Refsource CONFIRMIssue TrackingThird Party AdvisoryWEBREPORT
www.securityfocus.com/bid/65441VDB EntryX Refsource BIDThird Party AdvisoryWEB
github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rstX Refsource CONFIRMThird Party AdvisoryWEB
exchange.xforce.ibmcloud.com/vulnerabilities/91318VDB EntryX Refsource XFThird Party AdvisoryWEB
www.openwall.com/lists/oss-security/2014/02/08/3Mailing ListX Refsource MLISTThird Party AdvisoryWEB
lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.htmlVendor AdvisoryX Refsource FEDORAThird Party AdvisoryWEB

Show all 16 references

Related vulnerabilities

CVE-2021-41495debiannumpy+211.24%4y ago17-12-2021 19:25Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place CVE-2021-41496debiannumpy+30.40%4y ago17-12-2021 19:56Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally)CVE-2021-34141debiannumpy+41.68%4y ago17-12-2021 18:43An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."CVE-2021-33430debiannumpy+41.16%4y ago17-12-2021 18:36A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user CVE-2014-1859debianpython-numpy+40.47%8y ago08-01-2018 19:00(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.CVE-2017-12852ubuntupython-numpy+62.71%9y ago15-08-2017 16:00The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.

All vulnerabilities innumpy

CVE-2014-1858: numpy Improper Input Validation

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References