What’s Vulnerable › Vulnerabilities

CVE-2008-1887

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2008-04-18 · updated 2026-06-16
• Weakness: CWE-120

Description

Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString_FromStringAndSize function, which allocates less memory than expected when assert() is disabled and triggers a buffer overflow.

Affected products

• Canonical Ubuntu Linux: 6.06, 7.04, 7.10, 8.04
• Debian Linux: 4.0
• Python: through 2.5.2

References

• http://bugs.python.org/issue2587
• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
• http://secunia.com/advisories/29889
• http://secunia.com/advisories/30872
• http://secunia.com/advisories/31255
• http://secunia.com/advisories/31365
• http://secunia.com/advisories/31518
• http://secunia.com/advisories/31687
• http://secunia.com/advisories/33937
• http://secunia.com/advisories/37471
• http://security.gentoo.org/glsa/glsa-200807-01.xml

Get alerted when CVE-2008-1887 or the next vulnerability affects your stack