MGASA-2014-0285

Advisory lineage Upstream: 2 Downstream: 0
Published: 08 Jul 2014, 22:35
Last modified:16 Apr 2026, 06:22

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 Jul 2014, 22:35
Published
Vulnerability first disclosed
16 Apr 2026, 06:22
Last Modified
Vulnerability information updated

Description

Updated python & python3 packages fix two vulnerabilities Updated python and python3 packages fix security vulnerabilities: Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used as an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616). The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary scripts in the server's document root (CVE-2014-4650).

Affected Systems

  • mageia•python

    < 2.7.6-1.2.mga3

  • mageia•python3

    < 3.3.0-4.9.mga3

  • mageia•python

    < 2.7.6-1.2.mga4

  • mageia•python3

    < 3.3.2-13.4.mga4

References (5)