usn-3134-1
Vulnerability from osv_ubuntu
Published
2016-11-22 18:51
Modified
2026-04-22 07:36
Summary
python2.7, python3.2, python3.4, python3.5 vulnerabilities
Details
It was discovered that the smtplib library in Python did not return an error when StartTLS fails. A remote attacker could possibly use this to expose sensitive information. (CVE-2016-0772)
Rémi Rampin discovered that Python would not protect CGI applications from contents of the HTTP_PROXY environment variable when based on the contents of the Proxy header from HTTP requests. A remote attacker could possibly use this to cause a CGI application to redirect outgoing HTTP requests. (CVE-2016-1000110)
Insu Yun discovered an integer overflow in the zipimporter module in Python that could lead to a heap-based overflow. An attacker could use this to craft a special zip file that when read by Python could possibly execute arbitrary code. (CVE-2016-5636)
Guido Vranken discovered that the urllib modules in Python did not properly handle carriage return line feed (CRLF) in headers. A remote attacker could use this to craft URLs that inject arbitrary HTTP headers. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5699)
References
{
"affected": [
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2016-0772",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2016-5636",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2016-5699",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2016-1000110",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:14.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "idle-python2.7",
"binary_version": "2.7.6-8ubuntu0.3"
},
{
"binary_name": "libpython2.7",
"binary_version": "2.7.6-8ubuntu0.3"
},
{
"binary_name": "libpython2.7-minimal",
"binary_version": "2.7.6-8ubuntu0.3"
},
{
"binary_name": "libpython2.7-stdlib",
"binary_version": "2.7.6-8ubuntu0.3"
},
{
"binary_name": "libpython2.7-testsuite",
"binary_version": "2.7.6-8ubuntu0.3"
},
{
"binary_name": "python2.7",
"binary_version": "2.7.6-8ubuntu0.3"
},
{
"binary_name": "python2.7-examples",
"binary_version": "2.7.6-8ubuntu0.3"
},
{
"binary_name": "python2.7-minimal",
"binary_version": "2.7.6-8ubuntu0.3"
}
]
},
"package": {
"ecosystem": "Ubuntu:14.04:LTS",
"name": "python2.7",
"purl": "pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=source\u0026distro=trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.6-8ubuntu0.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.7.5-8ubuntu3",
"2.7.5-8ubuntu4",
"2.7.6-2",
"2.7.6-2ubuntu1",
"2.7.6-3",
"2.7.6-3ubuntu1",
"2.7.6-4",
"2.7.6-4ubuntu1",
"2.7.6-5",
"2.7.6-7",
"2.7.6-8",
"2.7.6-8ubuntu0.2"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2016-0772",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2016-5636",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2016-5699",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2016-1000110",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:14.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "idle-python3.4",
"binary_version": "3.4.3-1ubuntu1~14.04.5"
},
{
"binary_name": "libpython3.4",
"binary_version": "3.4.3-1ubuntu1~14.04.5"
},
{
"binary_name": "libpython3.4-minimal",
"binary_version": "3.4.3-1ubuntu1~14.04.5"
},
{
"binary_name": "libpython3.4-stdlib",
"binary_version": "3.4.3-1ubuntu1~14.04.5"
},
{
"binary_name": "libpython3.4-testsuite",
"binary_version": "3.4.3-1ubuntu1~14.04.5"
},
{
"binary_name": "python3.4",
"binary_version": "3.4.3-1ubuntu1~14.04.5"
},
{
"binary_name": "python3.4-examples",
"binary_version": "3.4.3-1ubuntu1~14.04.5"
},
{
"binary_name": "python3.4-minimal",
"binary_version": "3.4.3-1ubuntu1~14.04.5"
},
{
"binary_name": "python3.4-venv",
"binary_version": "3.4.3-1ubuntu1~14.04.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:14.04:LTS",
"name": "python3.4",
"purl": "pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=source\u0026distro=trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.3-1ubuntu1~14.04.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.4~b1-0ubuntu3",
"3.4~b1-4ubuntu4",
"3.4~b1-4ubuntu6",
"3.4~b1-5ubuntu2",
"3.4~b2-1",
"3.4~b3-1ubuntu1",
"3.4~rc1-1build1",
"3.4~rc2-1",
"3.4~rc3-0ubuntu1",
"3.4.0-1",
"3.4.0-2ubuntu1",
"3.4.0-2ubuntu1.1",
"3.4.3-1ubuntu1~14.04.1",
"3.4.3-1ubuntu1~14.04.3",
"3.4.3-1ubuntu1~14.04.4"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2016-0772",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2016-5636",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2016-1000110",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:16.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "idle-python2.7",
"binary_version": "2.7.12-1ubuntu0~16.04.1"
},
{
"binary_name": "libpython2.7",
"binary_version": "2.7.12-1ubuntu0~16.04.1"
},
{
"binary_name": "libpython2.7-minimal",
"binary_version": "2.7.12-1ubuntu0~16.04.1"
},
{
"binary_name": "libpython2.7-stdlib",
"binary_version": "2.7.12-1ubuntu0~16.04.1"
},
{
"binary_name": "libpython2.7-testsuite",
"binary_version": "2.7.12-1ubuntu0~16.04.1"
},
{
"binary_name": "python2.7",
"binary_version": "2.7.12-1ubuntu0~16.04.1"
},
{
"binary_name": "python2.7-examples",
"binary_version": "2.7.12-1ubuntu0~16.04.1"
},
{
"binary_name": "python2.7-minimal",
"binary_version": "2.7.12-1ubuntu0~16.04.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:16.04:LTS",
"name": "python2.7",
"purl": "pkg:deb/ubuntu/python2.7@2.7.12-1ubuntu0~16.04.1?arch=source\u0026distro=xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.12-1ubuntu0~16.04.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.7.10-4ubuntu1",
"2.7.10-4ubuntu2",
"2.7.11-2",
"2.7.11-3",
"2.7.11-4",
"2.7.11-6",
"2.7.11-7",
"2.7.11-7ubuntu1",
"2.7.12-1~16.04"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2016-0772",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2016-5636",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2016-1000110",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:16.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "idle-python3.5",
"binary_version": "3.5.2-2ubuntu0~16.04.1"
},
{
"binary_name": "libpython3.5",
"binary_version": "3.5.2-2ubuntu0~16.04.1"
},
{
"binary_name": "libpython3.5-minimal",
"binary_version": "3.5.2-2ubuntu0~16.04.1"
},
{
"binary_name": "libpython3.5-stdlib",
"binary_version": "3.5.2-2ubuntu0~16.04.1"
},
{
"binary_name": "libpython3.5-testsuite",
"binary_version": "3.5.2-2ubuntu0~16.04.1"
},
{
"binary_name": "python3.5",
"binary_version": "3.5.2-2ubuntu0~16.04.1"
},
{
"binary_name": "python3.5-examples",
"binary_version": "3.5.2-2ubuntu0~16.04.1"
},
{
"binary_name": "python3.5-minimal",
"binary_version": "3.5.2-2ubuntu0~16.04.1"
},
{
"binary_name": "python3.5-venv",
"binary_version": "3.5.2-2ubuntu0~16.04.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:16.04:LTS",
"name": "python3.5",
"purl": "pkg:deb/ubuntu/python3.5@3.5.2-2ubuntu0~16.04.1?arch=source\u0026distro=xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.2-2ubuntu0~16.04.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.0-3",
"3.5.0-3ubuntu1",
"3.5.1~rc1-2ubuntu1",
"3.5.1-1",
"3.5.1-2",
"3.5.1-3",
"3.5.1-5",
"3.5.1-6ubuntu1",
"3.5.1-6ubuntu2",
"3.5.1-9ubuntu1",
"3.5.1-10",
"3.5.2-2~16.01",
"3.5.2-2~16.04"
]
}
],
"aliases": [],
"details": "It was discovered that the smtplib library in Python did not return an\nerror when StartTLS fails. A remote attacker could possibly use this to\nexpose sensitive information. (CVE-2016-0772)\n\nR\u00e9mi Rampin discovered that Python would not protect CGI applications\nfrom contents of the HTTP_PROXY environment variable when based on\nthe contents of the Proxy header from HTTP requests. A remote attacker\ncould possibly use this to cause a CGI application to redirect outgoing\nHTTP requests. (CVE-2016-1000110)\n\nInsu Yun discovered an integer overflow in the zipimporter module in\nPython that could lead to a heap-based overflow. An attacker could\nuse this to craft a special zip file that when read by Python could\npossibly execute arbitrary code. (CVE-2016-5636)\n\nGuido Vranken discovered that the urllib modules in Python did\nnot properly handle carriage return line feed (CRLF) in headers. A\nremote attacker could use this to craft URLs that inject arbitrary\nHTTP headers. This issue only affected Ubuntu 12.04 LTS and Ubuntu\n14.04 LTS. (CVE-2016-5699)\n",
"id": "USN-3134-1",
"modified": "2026-04-22T07:36:33Z",
"published": "2016-11-22T18:51:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-3134-1"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2016-0772"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2016-5636"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2016-5699"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2016-1000110"
}
],
"related": [],
"schema_version": "1.7.0",
"summary": "python2.7, python3.2, python3.4, python3.5 vulnerabilities",
"upstream": [
"UBUNTU-CVE-2016-0772",
"UBUNTU-CVE-2016-5636",
"UBUNTU-CVE-2016-5699",
"UBUNTU-CVE-2016-1000110"
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…