Memory corruption in Python - CVE-2018-1000030

Vulnerability identifier: #VU10956

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000030

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists due to race condition. A remote attacker can trigger memory corruption and cause the service to crash or possibly execute arbitrary code with elevated privileges on the target system.

Python
Gentoo Linux
Ubuntu
openSUSE Leap
python2.7 (Ubuntu package)
python2.7-minimal (Ubuntu package)
python3.4 (Ubuntu package)
python3.4-minimal (Ubuntu package)
python3.5-minimal (Ubuntu package)
python3.5 (Ubuntu package)

Install update from vendor's website.

python2.7 (Ubuntu package) - addressed in versions 2.7.6-8ubuntu0.5, 2.7.12-1ubuntu0~16.04.4
python2.7-minimal (Ubuntu package) - addressed in versions 2.7.6-8ubuntu0.5, 2.7.12-1ubuntu0~16.04.4
python3.4 (Ubuntu package) - update to 3.4.3-1ubuntu1~14.04.7
python3.4-minimal (Ubuntu package) - update to 3.4.3-1ubuntu1~14.04.7
python3.5-minimal (Ubuntu package) - update to 3.5.2-2ubuntu0~16.04.5
python3.5 (Ubuntu package) - update to 3.5.2-2ubuntu0~16.04.5

• https://bugs.python.org/issue31530

• Privilege escalation in Python
• OpenSUSE Linux update for python
• Gentoo update for Python
• Ubuntu update for python2.7, python3.4, python3.5