A heap-based buffer overflow vulnerability was found in zipimporter module.
1116 bytes_size = compress == 0 ? data_size : data_size + 1;
1117 if (bytes_size == 0)
1119 raw_data = PyBytes_FromStringAndSize((char *)NULL, bytes_size);
data_size is not sanitized, so if comepress != 0 and data_size = -1, then it overflows and becomes 0. Right after then it's incremented and becomes 1. In that case, python allocates small portion of heap, which is later overflowed using fread.
Created python tracking bugs for this issue:
Affects: fedora-all [bug 1345858]
Created jython tracking bugs for this issue:
Affects: fedora-all [bug 1345857]
Affects: epel-5 [bug 1345861]
Created python26 tracking bugs for this issue:
Affects: epel-5 [bug 1345860]
Created python3 tracking bugs for this issue:
Affects: fedora-all [bug 1345859]
The patches identified in comment#0 and upstream tracker are not complete and do not prevent the attached "crash.py" reproducer. These do:
To exploit this flaw, an attacker would need to be able to place crafted files on the python import path. Since this already presents the opportunity for arbitrary code execution, this issue is rated as having Low security impact.
Further, the flaw is not present in either PyPy or Jython, but only in the CPython interpreter. CPython is known to be unsuitable to create a sandbox for running untrusted user code; for this purpose either PyPy or Jython are suggested as a better fountation.
Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Created python34 tracking bugs for this issue:
Affects: epel-7 [bug 1356365]
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2016:2586 https://rhn.redhat.com/errata/RHSA-2016-2586.html
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):