CVE-2017-1000158

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2017
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10001597.8Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.CVE-2017-10001605.4EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection CVE-2017-10001636.1The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redir CVE-2017-10001645.4Tine 2.0 version 2017.02.4 is vulnerable to XSS in the Addressbook resulting code execution and privilege escalation CVE-2017-10001686.5sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys CVE-2017-10001699.8QuickerBB version <= 0.7.2 is vulnerable to arbitrary file writes which can lead to remote code execution. This can lead to the complete tak CVE-2017-10001707.5jqueryFileTree 2.1.5 and older Directory Traversal CVE-2017-10001719.8Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text.CVE-2017-10001729.8Creolabs Gravity Version: 1.0 Use-After-Free Possible code execution. An example of a Heap-Use-After-Free after the 'sublexer' pointer has b CVE-2017-10001739.8Creolabs Gravity Version: 1.0 Heap Overflow Potential Code Execution. By creating a large loop whiling pushing data to a buffer, we can brea CVE-2017-10001745.5In SWFTools, an address access exception was found in swfdump swf_GetBits().CVE-2017-10001765.5In SWFTools, a memcpy buffer overflow was found in swfc.