MGASA-2014-0286

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2014-0286.html
Import Source
https://advisories.mageia.org/MGASA-2014-0286.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2014-0286
Related
Published
2014-07-08T22:38:10Z
Modified
2014-07-08T22:38:03Z
Summary
Updated python-simplejson package fixes security vulnerability
Details

Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616).

This issue also affected the python-simplejson package, which has been patched to fix the bug.

References
Credits

Affected packages

Mageia:3 / python-simplejson

Package

Name
python-simplejson
Purl
pkg:rpm/mageia/python-simplejson?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.0-2.1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:4 / python-simplejson

Package

Name
python-simplejson
Purl
pkg:rpm/mageia/python-simplejson?distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.0-3.1.mga4

Ecosystem specific 

{
    "section": "core"
}