Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2014-1912 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Python

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-120 — Classic Buffer Overflow14 documents10 sources
Severity
7.5HIGHNVD
EPSS
23.9%
top 3.96%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Debian Python2.7Apple MAC OS XApple OS X Yosemite V10.10.5 AND Security Update 2015-006+1 more
Timeline
PublishedMar 1
Latest updateSep 23

Description

Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages4 packages

▶debiandebian/python2.7< python2.7 2.7.6-6 (bullseye)
▶NVDpython/python47 versions+46
▶NVDapple/mac_os_x10.10.4

Patches

Patch: bugs.python.org ↗Patch: bugs.python.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-jhx7-j4rm-xpm8: Buffer overflow in the socket↗2022-05-13
▶
OSV
CVE-2014-1912: Buffer overflow in the socket↗2014-03-01
▶

💥Exploits & PoCs

1
Exploit-DB
Python - 'socket.recvfrom_into()' Remote Buffer Overflow↗2014-02-24
▶

📋Vendor Advisories

4
Ubuntu
Python vulnerability↗2014-03-03
▶
Red Hat
python: buffer overflow in socket.recvfrom_into()↗2014-01-14
▶
Debian
CVE-2014-1912: python2.7 - Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c i...↗2014
▶
Apple
CVE-2014-1912: OS X Yosemite v10.10.5 and Security Update 2015-006↗
▶

📄Research Papers

3
arXiv
ShadowBound: Efficient Heap Memory Protection Through Advanced Metadata Management and Customized Compiler Optimization↗2024-09-23
▶
arXiv
Path-wise Vulnerability Mitigation↗2024-05-25
▶
arXiv
Tightly Seal Your Sensitive Pointers with PACTight↗2022-03-28
▶

💬Community

3
Bugzilla
CVE-2014-1912 python26: python: buffer overflow in socket.recvfrom_into() [epel-5]↗2014-10-27
▶
Bugzilla
CVE-2014-1912 - Buffer overflow in the socket.recvfrom_into function↗2014-09-23
▶
Bugzilla
CVE-2014-1912 python: buffer overflow in socket.recvfrom_into()↗2014-02-06
▶