USN-2125-1: Python vulnerability

Releases

• Ubuntu 13.10
• Ubuntu 12.10
• Ubuntu 12.04
• Ubuntu 10.04

Packages

• python2.6 - An interactive high-level object-oriented language
• python2.7 - An interactive high-level object-oriented language
• python3.2 - An interactive high-level object-oriented language
• python3.3 - An interactive high-level object-oriented language

Details

Ryan Smith-Roberts discovered that Python incorrectly handled buffer sizes
when using the socket.recvfrom_into() function. An attacker could possibly
use this issue to cause Python to crash, resulting in denial of service, or
possibly execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 13.10

• python2.7-minimal - 2.7.5-8ubuntu3.1
• python3.3-minimal - 3.3.2-7ubuntu3.1
• python2.7 - 2.7.5-8ubuntu3.1
• python3.3 - 3.3.2-7ubuntu3.1

Ubuntu 12.10

• python3.3-minimal - 3.3.0-1ubuntu0.2
• python2.7 - 2.7.3-5ubuntu4.4
• python2.7-minimal - 2.7.3-5ubuntu4.4
• python3.2 - 3.2.3-6ubuntu3.5
• python3.3 - 3.3.0-1ubuntu0.2
• python3.2-minimal - 3.2.3-6ubuntu3.5

Ubuntu 12.04

• python2.7 - 2.7.3-0ubuntu3.5
• python2.7-minimal - 2.7.3-0ubuntu3.5
• python3.2 - 3.2.3-0ubuntu3.6
• python3.2-minimal - 3.2.3-0ubuntu3.6

Ubuntu 10.04

• python2.6-minimal - 2.6.5-1ubuntu6.3
• python2.6 - 2.6.5-1ubuntu6.3

In general, a standard system update will make all the necessary changes.

References

• CVE-2014-1912