What’s Vulnerable › Vulnerabilities

CVE-2010-1634

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2010-05-27 · updated 2026-06-16
• Weakness: CWE-190

Description

Multiple integer overflows in audioop.c in the audioop module in Python 2.6, 2.7, 3.1, and 3.2 allow context-dependent attackers to cause a denial of service (application crash) via a large fragment, as demonstrated by a call to audioop.lin2lin with a long string in the first argument, leading to a buffer overflow. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3143.5.

Affected products

• Canonical Ubuntu Linux: 8.04, 10.04, 11.04, 11.10
• Fedoraproject Fedora: 13
• Opensuse: 11.2, 11.3
• Python: from 2.5.0 before 2.5.6; from 2.6.0 before 2.6.6; from 3.1.0 before 3.1.3 — fixed in 2.5.6, 2.6.6, 3.1.3
• SUSE Linux Enterprise Server: 10-sp3, 11, 11-sp1

How to fix

Upgrade to a fixed version: Python 2.5.6, 2.6.6, 3.1.3. Check the vendor advisory for mitigations.

References

• http://bugs.python.org/issue8674
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042751.html
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
• http://secunia.com/advisories/39937
• http://secunia.com/advisories/40194
• http://secunia.com/advisories/42888
• http://secunia.com/advisories/43068
• http://secunia.com/advisories/50858
• http://secunia.com/advisories/51024
• http://secunia.com/advisories/51040

Get alerted when CVE-2010-1634 or the next vulnerability affects your stack