Vulnerability in the utf-16 decoder after error handling¶
Warning
This resource is maintained for historical reference and does not contain the latest vulnerability info for Python.
The canonical database for vulnerabilities affecting Python is available on GitHub in the Open Source Vulnerability (OSV) format. This vulnerability can be viewed online at the Open Source Vulnerability Database.
Vulnerability in the UTF-16 decoder after error handling.
Dates:
- Disclosure date: 2012-04-14
Fixed In¶
- Python 2.7.4 (2013-04-06) fixed by commit 715a63b (branch 2.7) (2012-07-20)
- Python 3.2.4 (2013-04-06) fixed by commit 715a63b (branch 2.7) (2012-07-20)
- Python 3.3.0 (2012-09-29) fixed by commit b4bbee2 (branch 3.3) (2012-07-20)
Python issue¶
CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling.
- Python issue: bpo-14579
- Creation date: 2012-04-14
- Reporter: Serhiy Storchaka
CVE-2012-2135¶
The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors.
- CVE ID: CVE-2012-2135
- Published: 2012-08-14
- CVSS Score: 6.4
Timeline¶
Timeline using the disclosure date 2012-04-14 as reference:
- 2012-04-14: Disclosure date
- 2012-04-14: Python issue bpo-14579 reported by Serhiy Storchaka
- 2012-07-20 (+97 days): commit 715a63b (branch 2.7)
- 2012-07-20 (+97 days): commit b4bbee2 (branch 3.3)
- 2012-08-14 (+122 days): CVE-2012-2135 published
- 2012-09-29: Python 3.3.0 released
- 2013-04-06 (+357 days): Python 2.7.4 released
- 2013-04-06 (+357 days): Python 3.2.4 released