5.9

CVE-2014-4616: opensuse_project opensuse Improper Validation of Array Index

Modified
AliasesALPINE-CVE-2014-4616MGASA-2014-0286GHSA-9772-cwx9-r4cj
Published 24-08-2017Last modified 06-08-2024

Vulnerability summary

CVE-2014-4616 is a medium (CVSS 5.9) Improper Validation of Array Index vulnerability in opensuse_project opensuse. EPSS estimates a 7.85% chance of exploitation in the next 30 days, higher than 94.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.9/10
010
Medium · v3.1 (NVD)
EPSS score
7.85%
0%100%
Low · -0.28 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 5 · Related 1
MGASA-2014-0285RHEA-2014:1175RHSA-2015:1064RHSA-2015:2101USN-2653-1

Timeline

  1. 24-08-2017
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.

CVSS metrics

7 scores · 5 sources · 3 versions

EPSS trend

Probability

7.85%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

Decrease -0.28 pp

From 8.13% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (hackerone.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Alpine2 products
  • python≥ 2.7.0, < 2.7.7-r0
  • python2< 2.7.7-r0
Mageia2 products
  • python-simplejson< 2.6.0-2.1.mga3
  • python-simplejson< 3.3.0-3.1.mga4
Ubuntu2 products
  • python2.7< 2.7.6-8ubuntu0.2
  • python3.4< 3.4.0-2ubuntu1.1
Debian1 product
  • python2.7< 2.7.7-1
Opensuse1 product
Opensuse_project1 product
PyPI1 product
  • simplejson< 2.6.1
Python1 product
  • python≥ 2.7.0, < 2.7.7 | ≥ 3.0.0, < 3.2.6 | ≥ 3.3.0, < 3.3.6 | ≥ 3.4.0, < 3.4.1
Simplejson_project1 product

9 vendors · 12 products

References

21 links
Show all 21 references