CVE-2013-7459

Name
CVE-2013-7459
Description
Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Exploit https://pony7.fr/ctf:public:32c3:cryptmsg
Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJ37R2YLX56YZABFNAOWV4VTHTGYREAE/
Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C6BWNADPLKDBBQBUT3P75W7HAJCE7M3B/
Patch https://github.com/dlitz/pycrypto/issues/176
Patch https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1409754
Third Party Advisory http://www.securityfocus.com/bid/95122
Mailing List http://www.openwall.com/lists/oss-security/2016/12/27/8
GENTOO https://security.gentoo.org/glsa/201702-14
cve@mitre.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C6BWNADPLKDBBQBUT3P75W7HAJCE7M3B/
cve@mitre.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJ37R2YLX56YZABFNAOWV4VTHTGYREAE/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:dlitz:pycrypto:*:*:*:*:*:*:*:* pycrypto >= None <= 2.6.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status