.. _utf-16-decoder-after-error-handling:

Vulnerability in the utf-16 decoder after error handling
========================================================

.. warning::
    This resource is maintained for historical reference and **does not contain the latest vulnerability info for Python**.

    The `canonical database for vulnerabilities affecting Python <https://github.com/psf/advisory-database>`_ is available on GitHub
    in the Open Source Vulnerability (OSV) format. This vulnerability can be viewed online at the
    `Open Source Vulnerability Database <https://osv.dev/list?ecosystem=&q=CVE-2012-2135>`_.

Vulnerability in the UTF-16 decoder after error handling.

Dates:

* Disclosure date: **2012-04-14**

Fixed In
--------

* Python **2.7.4** (2013-04-06) fixed by `commit 715a63b (branch 2.7) <https://github.com/python/cpython/commit/715a63b78349952ccc0fb3dd3139e2d822006d35>`_ (2012-07-20)
* Python **3.2.4** (2013-04-06) fixed by `commit 715a63b (branch 2.7) <https://github.com/python/cpython/commit/715a63b78349952ccc0fb3dd3139e2d822006d35>`_ (2012-07-20)
* Python **3.3.0** (2012-09-29) fixed by `commit b4bbee2 (branch 3.3) <https://github.com/python/cpython/commit/b4bbee25b1e3f4bccac222f806b3138fb72439d6>`_ (2012-07-20)

Python issue
------------

CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling.

* Python issue: `bpo-14579 <https://bugs.python.org/issue14579>`_
* Creation date: 2012-04-14
* Reporter: Serhiy Storchaka

CVE-2012-2135
-------------

The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors.

* CVE ID: `CVE-2012-2135 <https://nvd.nist.gov/vuln/detail/CVE-2012-2135/>`_
* Published: 2012-08-14
* `CVSS Score <https://nvd.nist.gov/cvss.cfm>`_: 6.4

Timeline
--------

Timeline using the disclosure date **2012-04-14** as reference:

* 2012-04-14: Disclosure date
* 2012-04-14: `Python issue bpo-14579 <https://bugs.python.org/issue14579>`_ reported by Serhiy Storchaka
* 2012-07-20 (**+97 days**): `commit 715a63b (branch 2.7) <https://github.com/python/cpython/commit/715a63b78349952ccc0fb3dd3139e2d822006d35>`_
* 2012-07-20 (**+97 days**): `commit b4bbee2 (branch 3.3) <https://github.com/python/cpython/commit/b4bbee25b1e3f4bccac222f806b3138fb72439d6>`_
* 2012-08-14 (**+122 days**): CVE-2012-2135 published
* 2012-09-29: Python 3.3.0 released
* 2013-04-06 (**+357 days**): Python 2.7.4 released
* 2013-04-06 (**+357 days**): Python 3.2.4 released