CVE-2007-4965

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-09-18 · updated 2026-06-16
Weakness: CWE-190

Description

Multiple integer overflows in the imageop module in Python 2.5.1 and earlier allow context-dependent attackers to cause a denial of service (application crash) and possibly obtain sensitive information (memory contents) via crafted arguments to (1) the tovideo method, and unspecified other vectors related to (2) imageop.c, (3) rbgimgmodule.c, and other files, which trigger heap-based buffer overflows.

Affected products

Python: through 2.5.1

References

http://bugs.gentoo.org/show_bug.cgi?id=192876
http://docs.info.apple.com/article.html?artnum=307179
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065826.html
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
http://lists.vmware.com/pipermail/security-announce/2008/000005.html
http://secunia.com/advisories/26837
http://secunia.com/advisories/27460
http://secunia.com/advisories/27562
http://secunia.com/advisories/27872
http://secunia.com/advisories/28136

Get alerted when CVE-2007-4965 or the next vulnerability affects your stack