Out-of-bounds write in Python - CVE-2010-2089

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU110151

Out-of-bounds write in Python - CVE-2010-2089

Published: August 16, 2022 / Updated: June 3, 2025


Vulnerability identifier: #VU110151
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2010-2089
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-dependent attackers to cause a denial of service (memory corruption and application crash) via crafted arguments, as demonstrated by a call to audioop.reverse with a one-byte string, a different vulnerability than CVE-2010-1634.


Affected software

Python
Fedora
Ubuntu
python2.5-minimal (Ubuntu package)
python2.5 (Ubuntu package)
python2.6-minimal (Ubuntu package)
python2.6 (Ubuntu package)
python3.1-minimal (Ubuntu package)
python3.1 (Ubuntu package)
python26

How to mitigate CVE-2010-2089

Install update from vendor's website.

Python - update to 2.7 rc2
python2.5-minimal (Ubuntu package) - update to 2.5.2-2ubuntu6.2
python2.5 (Ubuntu package) - update to 2.5.2-2ubuntu6.2
python2.6-minimal (Ubuntu package) - addressed in versions 2.6.5-1ubuntu6.1, 2.6.6-6ubuntu7.1, 2.6.7-4ubuntu1.1
python2.6 (Ubuntu package) - addressed in versions 2.6.5-1ubuntu6.1, 2.6.6-6ubuntu7.1, 2.6.7-4ubuntu1.1
python3.1-minimal (Ubuntu package) - addressed in versions 3.1.2-0ubuntu3.2, 3.1.3-1ubuntu1.2
python3.1 (Ubuntu package) - addressed in versions 3.1.2-0ubuntu3.2, 3.1.3-1ubuntu1.2
python26 - update to 2.6.5-5.el5

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins