← Back

CVE-2014-4616

nvd nist
Published: Aug 24, 2017Modified: May 13, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.2 / Impact: 3.6
Source: NVD

Description

Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.

Affected (7)

Show all products
Python: Python · Simplejson Project: Simplejson · Opensuse: Opensuse · Opensuse Project: Opensuse
Python
1 product
Python
Simplejson Project
1 product
Simplejson
Opensuse
1 product
Opensuse
Opensuse Project
1 product
Opensuse
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Python
Python
From 2.7.0 to 2.7.7
Python
From 3.0.0 to 3.2.6
Python
From 3.3.0 to 3.3.6
Python
From 3.4.0 to 3.4.1
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Simplejson
Before 2.6.1
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Opensuse
Version 13.1
Opensuse
Version 12.3

Related CWEs

CWE-129
Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

References (18)

Source: cve@mitre.org
Issue TrackingVendor Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Issue TrackingMailing ListThird Party Advisory
Source: cve@mitre.org
Issue TrackingPatchThird Party Advisory
Source: cve@mitre.org
ExploitPatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingMailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party AdvisoryVDB Entry

Timeline

No history available yet.