Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 596
Alerts This Week
Warning Icon 1 596

Ubuntu 16.10 USN-3199-1 Critical: Python Crypto Heap Overflow

ubuntu
Calendar Grey February 17, 2017
Dist Ubuntu Esm H88
Essential Python Crypto patch released for Ubuntu users, correcting issues triggered by specially designed inputs that lead to system crashes.
Programs using the Python Cryptography Toolkit could be made to crash or run programs if they receive specially crafted network traffic or other input.

Summary

Programs using the Python Cryptography Toolkit could be made to crash or run

programs if they receive specially crafted network traffic or other input.

Software Description:

- python-crypto: cryptographic algorithms and protocols for Python

Details:

It was discovered that the ALGnew function in block_templace.c in the Python

Cryptography Toolkit contained a heap-based buffer overflow vulnerability.

A remote attacker could use this flaw to execute arbitrary code by using

a crafted initialization vector parameter.

Topics%20covered

Topics Covered

security advisory buffer overflow critical Ubuntu remote execution heap overflow Python Crypto

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  python-crypto                   2.6.1-6ubuntu0.16.10.2
  python3-crypto                  2.6.1-6ubuntu0.16.10.2

Ubuntu 16.04 LTS:
  python-crypto                   2.6.1-6ubuntu0.16.04.1
  python3-crypto                  2.6.1-6ubuntu0.16.04.1

Ubuntu 14.04 LTS:
  python-crypto                   2.6.1-4ubuntu0.1
  python3-crypto                  2.6.1-4ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-3199-1

  CVE-2013-7459

Severity
critical
Lowest
Low
Medium
High
Critical

February 16, 2017

Topics%20covered

Topics Covered

security advisory buffer overflow critical Ubuntu remote execution heap overflow Python Crypto

Package Information

  https://launchpad.net/ubuntu/+source/python-crypto/2.6.1-6ubuntu0.16.10.2
  https://launchpad.net/ubuntu/+source/python-crypto/2.6.1-6ubuntu0.16.04.1
  https://launchpad.net/ubuntu/+source/python-crypto/2.6.1-4ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.