Three issues in Python have been reported: ============================================================= CVE-2008-3142 Justin Ferguson: Multiple buffer overflows in unicode processing The unicode_resize() function acts essentially as a wrapper to realloc(), it accomplishes this via the PyMem_RESIZE() macro which factors the size with the size of the type, in this case it multiplies by two as Py_UNICODE is typedef'd to a wchar_t. When resizing large strings, this results in an incorrect allocation that in turn leads to buffer overflow. Bug: http://bugs.python.org/issue2620 Proposed patch: http://bugs.python.org/file10825/issue2620-gps02-patch.txt Only affects 32 bit systems. ============================================================= CVE-2008-3143 "Google integer overflows" Added checks for integer overflows, contributed by Google. Some are only available if asserts are left in the code, in cases where they can't be triggered from Python code. http://svn.python.org/view?rev=60793&view=rev Fixes are in 2.5.2. ============================================================= CVE-2008-3144 Justin Ferguson PyOS integer underflow/overflow Fix potential integer underflow and overflow conditions in the PyOS_vsnprintf C API function. This is a backport of r63728 and r63734 from trunk. http://svn.python.org/view?rev=63883&view=rev Fix issue2589: there was a potential integer overflow leading to memory corruption on esoteric platforms and incorrect behavior on normal platforms. http://bugs.python.org/issue2589 http://svn.python.org/view?rev=63728&view=rev Fix issue2588: Do not execute str[size-1] = '\0' when a 0 size is passed in. (The assert won't prevent this in non-debug builds). http://svn.python.org/view?rev=63734&view=rev http://bugs.python.org/issue2588
Created attachment 160679 [details, diff] python-2.4.4-CVE-2008-3144.patch
Created attachment 161577 [details, diff] python-2.4.4-CVE-2008-3142.patch
Created attachment 161579 [details, diff] python-2.4.4-CVE-2008-3143.patch
Fixed together with the patches from bug #230640
GLSA 200807-16
