Vulnerability in the utf-16 decoder after error handling¶
Warning
This resource is maintained for historical reference and does not contain the latest vulnerability info for Python.
The canonical database for vulnerabilities affecting Python is available on GitHub in the Open Source Vulnerability (OSV) format. This vulnerability can be viewed online at the Open Source Vulnerability Database.
Vulnerability in the UTF-16 decoder after error handling.
Dates:
Disclosure date: 2012-04-14
Fixed In¶
Python 2.7.4 (2013-04-06) fixed by commit 715a63b (branch 2.7) (2012-07-20)
Python 3.2.4 (2013-04-06) fixed by commit 715a63b (branch 2.7) (2012-07-20)
Python 3.3.0 (2012-09-29) fixed by commit b4bbee2 (branch 3.3) (2012-07-20)
Python issue¶
CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling.
Python issue: bpo-14579
Creation date: 2012-04-14
Reporter: Serhiy Storchaka
CVE-2012-2135¶
The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors.
CVE ID: CVE-2012-2135
Published: 2012-08-14
CVSS Score: 6.4
Timeline¶
Timeline using the disclosure date 2012-04-14 as reference:
2012-04-14: Disclosure date
2012-04-14: Python issue bpo-14579 reported by Serhiy Storchaka
2012-07-20 (+97 days): commit 715a63b (branch 2.7)
2012-07-20 (+97 days): commit b4bbee2 (branch 3.3)
2012-08-14 (+122 days): CVE-2012-2135 published
2012-09-29: Python 3.3.0 released
2013-04-06 (+357 days): Python 2.7.4 released
2013-04-06 (+357 days): Python 3.2.4 released