CVE-2014-4616
Fixed in a distro release EPSS 8%
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.
Products: python, simplejson_project simplejson, opensuse, opensuse_project opensuse
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | simplejson | 2.6.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.4 | python | 2.7.7-r0 |
| Alpine 3.5 | python2 | 2.7.7-r0 |
| Alpine 3.6 | python2 | 2.7.7-r0 |
| Debian 11 | python2.7 | 2.7.7-1 |
| Red Hat Enterprise Linux 7 | python | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-debug | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-debuginfo | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-devel | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-libs | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-test | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | python-tools | 0:2.7.5-34.el7 |
| Red Hat Enterprise Linux 7 | tkinter | 0:2.7.5-34.el7 |
| Red Hat rhel software collections 2 | python27 | 0:1.1-20.el7 |
| Red Hat rhel software collections 2 | python27 | 0:1.1-17.el6 |
| Red Hat rhel software collections 2 | python27-python | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-debug | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-debug | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-debuginfo | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-debuginfo | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-devel | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-devel | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-libs | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-libs | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-pip | 0:1.5.6-5.el7 |
| Red Hat rhel software collections 2 | python27-python-pip | 0:1.5.6-5.el6 |
| Red Hat rhel software collections 2 | python27-python-setuptools | 0:0.9.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-setuptools | 0:0.9.8-5.el7 |
| Red Hat rhel software collections 2 | python27-python-simplejson | 0:3.2.0-3.el7 |
| Red Hat rhel software collections 2 | python27-python-simplejson | 0:3.2.0-2.el6 |
| Red Hat rhel software collections 2 | python27-python-simplejson-debuginfo | 0:3.2.0-2.el6 |
| Red Hat rhel software collections 2 | python27-python-simplejson-debuginfo | 0:3.2.0-3.el7 |
| Red Hat rhel software collections 2 | python27-python-test | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-test | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-tools | 0:2.7.8-3.el7 |
| Red Hat rhel software collections 2 | python27-python-tools | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-python-wheel | 0:0.24.0-2.el7 |
| Red Hat rhel software collections 2 | python27-python-wheel | 0:0.24.0-2.el6 |
| Red Hat rhel software collections 2 | python27-runtime | 0:1.1-17.el6 |
| Red Hat rhel software collections 2 | python27-runtime | 0:1.1-20.el7 |
| Red Hat rhel software collections 2 | python27-scldevel | 0:1.1-17.el6 |
| Red Hat rhel software collections 2 | python27-scldevel | 0:1.1-20.el7 |
| Red Hat rhel software collections 2 | python27-tkinter | 0:2.7.8-3.el6 |
| Red Hat rhel software collections 2 | python27-tkinter | 0:2.7.8-3.el7 |
| Red Hat satellite 6.0 | foreman | 0:1.6.0.44-1.el7sat |
| Red Hat satellite 6.0 | foreman | 0:1.6.0.44-1.el6sat |
| Red Hat satellite 6.0 | foreman-compute | 0:1.6.0.44-1.el7sat |
| Red Hat satellite 6.0 | foreman-compute | 0:1.6.0.44-1.el6sat |
| Red Hat satellite 6.0 | foreman-gce | 0:1.6.0.44-1.el6sat |
| Red Hat satellite 6.0 | foreman-gce | 0:1.6.0.44-1.el7sat |
| Red Hat satellite 6.0 | foreman-libvirt | 0:1.6.0.44-1.el7sat |
| Red Hat satellite 6.0 | foreman-libvirt | 0:1.6.0.44-1.el6sat |
| Red Hat satellite 6.0 | foreman-ovirt | 0:1.6.0.44-1.el6sat |
| Red Hat satellite 6.0 | foreman-ovirt | 0:1.6.0.44-1.el7sat |
| Red Hat satellite 6.0 | foreman-postgresql | 0:1.6.0.44-1.el7sat |
| Red Hat satellite 6.0 | foreman-postgresql | 0:1.6.0.44-1.el6sat |
| Red Hat satellite 6.0 | foreman-proxy | 0:1.6.0.30-1.el6sat |
| Red Hat satellite 6.0 | foreman-proxy | 0:1.6.0.30-1.el7sat |
| Red Hat satellite 6.0 | foreman-vmware | 0:1.6.0.44-1.el6sat |
| Red Hat satellite 6.0 | foreman-vmware | 0:1.6.0.44-1.el7sat |
| Red Hat satellite 6.0 | katello | 0:1.5.0-30.el6sat |
| Red Hat satellite 6.0 | katello | 0:1.5.0-30.el7sat |
| Red Hat satellite 6.0 | libmongodb | 0:2.4.6-2.el6sat |
| Red Hat satellite 6.0 | mongodb | 0:2.4.9-3.el7sat |
| Red Hat satellite 6.0 | mongodb | 0:2.4.6-2.el6sat |
| Red Hat satellite 6.0 | mongodb-debuginfo | 0:2.4.9-3.el7sat |
| Red Hat satellite 6.0 | mongodb-debuginfo | 0:2.4.6-2.el6sat |
| Red Hat satellite 6.0 | mongodb-server | 0:2.4.9-3.el7sat |
| Red Hat satellite 6.0 | mongodb-server | 0:2.4.6-2.el6sat |
| Red Hat satellite 6.0 | python-anyjson | 0:0.3.3-4.el6sat |
| Red Hat satellite 6.0 | python-anyjson | 0:0.3.3-5.el7sat |
| Red Hat satellite 6.0 | python-httplib2 | 0:0.7.2-1.el6 |
| Red Hat satellite 6.0 | python-httplib2 | 0:0.6.0-6.el7sat |
| Red Hat satellite 6.0 | python-simplejson | 0:3.2.0-1.el7sat |
| Red Hat satellite 6.0 | python-simplejson-debuginfo | 0:3.2.0-1.el7sat |
| Red Hat satellite 6.0 | rubygem-hammer_cli_foreman | 0:0.1.1-16.el7sat |
| Red Hat satellite 6.0 | rubygem-hammer_cli_foreman | 0:0.1.1-16.el6sat |
| Red Hat satellite 6.0 | rubygem-hammer_cli_foreman_tasks | 0:0.0.3-3.el7sat |
| Red Hat satellite 6.0 | rubygem-hammer_cli_foreman_tasks | 0:0.0.3-3.el6sat |
| Red Hat satellite 6.0 | rubygem-kafo | 0:0.6.4-2.el7sat |
| Red Hat satellite 6.0 | rubygem-kafo | 0:0.6.4-2.el6sat |
| Red Hat satellite 6.0 | rubygem-kafo_parsers | 0:0.0.3-2.el6sat |
| Red Hat satellite 6.0 | rubygem-kafo_parsers | 0:0.0.3-2.el7sat |
| Red Hat satellite 6.0 | v8 | 1:3.14.5.10-9.el6sat |
| Red Hat satellite 6.0 | v8 | 1:3.14.5.10-11.el7sat |
| Red Hat satellite 6.0 | v8-debuginfo | 1:3.14.5.10-9.el6sat |
| Red Hat satellite 6.0 | v8-debuginfo | 1:3.14.5.10-11.el7sat |
| Red Hat satellite capsule 6.0 | foreman-proxy | 0:1.6.0.30-1.el7sat |
| Red Hat satellite capsule 6.0 | foreman-proxy | 0:1.6.0.30-1.el6sat |
| Red Hat satellite capsule 6.0 | libmongodb | 0:2.4.6-2.el6sat |
| Red Hat satellite capsule 6.0 | mongodb | 0:2.4.6-2.el6sat |
| Red Hat satellite capsule 6.0 | mongodb | 0:2.4.9-3.el7sat |
| Red Hat satellite capsule 6.0 | mongodb-debuginfo | 0:2.4.6-2.el6sat |
| Red Hat satellite capsule 6.0 | mongodb-debuginfo | 0:2.4.9-3.el7sat |
| Red Hat satellite capsule 6.0 | mongodb-server | 0:2.4.6-2.el6sat |
| Red Hat satellite capsule 6.0 | mongodb-server | 0:2.4.9-3.el7sat |
| Red Hat satellite capsule 6.0 | python-anyjson | 0:0.3.3-5.el7sat |
| Red Hat satellite capsule 6.0 | python-anyjson | 0:0.3.3-4.el6sat |
| Red Hat satellite capsule 6.0 | python-httplib2 | 0:0.6.0-6.el7sat |
| Red Hat satellite capsule 6.0 | python-httplib2 | 0:0.7.2-1.el6 |
| Red Hat satellite capsule 6.0 | python-simplejson | 0:3.2.0-1.el7sat |
| Red Hat satellite capsule 6.0 | python-simplejson-debuginfo | 0:3.2.0-1.el7sat |
| Red Hat satellite capsule 6.0 | rubygem-kafo | 0:0.6.4-2.el6sat |
| Red Hat satellite capsule 6.0 | rubygem-kafo | 0:0.6.4-2.el7sat |
| Red Hat satellite capsule 6.0 | rubygem-kafo_parsers | 0:0.0.3-2.el6sat |
| Red Hat satellite capsule 6.0 | rubygem-kafo_parsers | 0:0.0.3-2.el7sat |
| Red Hat satellite capsule 6.0 | v8 | 1:3.14.5.10-9.el6sat |
| Red Hat satellite capsule 6.0 | v8 | 1:3.14.5.10-11.el7sat |
| Red Hat satellite capsule 6.0 | v8-debuginfo | 1:3.14.5.10-11.el7sat |
| Red Hat satellite capsule 6.0 | v8-debuginfo | 1:3.14.5.10-9.el6sat |
| Ubuntu 14.04 LTS | python2.7 | 2.7.6-8ubuntu0.2 |
| Ubuntu 14.04 LTS | python3.4 | 3.4.0-2ubuntu1.1 |