CVE-2008-2315 json
Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to t…
published 2008-08-01 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-2311
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.4%
- EPSS 4.4% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the (1) stringobject, (2) unicodeobject, (3) bufferobject, (4) longobject, (5) tupleobject, (6) stropmodule, (7) gcmodule, and (8) mmapmodule modules. NOTE: The expandtabs integer overflows in stringobject and unicodeobject in 2.5.2 are covered by CVE-2008-5031.
Patch / fix
- python RHEL 3 2.2.3-6.11
- tkinter RHEL 3 2.2.3-6.11
- python-tools RHEL 3 2.2.3-6.11
- python RHEL 4 2.3.4-14.7.el4_8.2
- tkinter RHEL 4 2.3.4-14.7.el4_8.2
- python-tools RHEL 4 2.3.4-14.7.el4_8.2
- python RHEL 5 2.4.3-24.el5_3.6
- tkinter RHEL 5 2.4.3-24.el5_3.6
red hat advisories RHSA-2009:1178RHSA-2009:1177RHSA-2009:1176
- python SLE Module for Python 2 15 SP1, SLE Module for Desktop Applications 15 SP1, SLE Module for Desktop Applications 15 +2 more 2.7.17-7.32.2
- python-base SLE Module for Python 2 15 SP1, SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 2.7.17-7.32.1
suse advisories SUSE-SU-2020:0234-1
- python openSUSE Tumbleweed 2.7.18-8.1
opensuse advisories openSUSE-SU-2024:11202-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2008-2315 updated
python: Multiple integer overflows in python core
-
Red Hat Desktop version 3 python 2.2.3-6.11, tkinter 2.2.3-6.11, python-tools 2.2.3-6.11fixed: vendor fix RHSA-2009:1178
-
Red Hat Enterprise Linux (v. 5 server) python 2.4.3-24.el5_3.6, tkinter 2.4.3-24.el5_3.6, python-tools 2.4.3-24.el5_3.6fixed: vendor fix RHSA-2009:1176
-
Red Hat Enterprise Linux AS version 3 python 2.2.3-6.11, tkinter 2.2.3-6.11, python-tools 2.2.3-6.11fixed: vendor fix RHSA-2009:1178
-
Red Hat Enterprise Linux AS version 4 python 2.3.4-14.7.el4_8.2, tkinter 2.3.4-14.7.el4_8.2, python-tools 2.3.4-14.7.el4_8.2fixed: vendor fix RHSA-2009:1177
-
Red Hat Enterprise Linux Desktop (v. 5 client) python 2.4.3-24.el5_3.6, tkinter 2.4.3-24.el5_3.6, python-tools 2.4.3-24.el5_3.6fixed: vendor fix RHSA-2009:1176
-
Red Hat Enterprise Linux Desktop version 4 python 2.3.4-14.7.el4_8.2, tkinter 2.3.4-14.7.el4_8.2, python-tools 2.3.4-14.7.el4_8.2fixed: vendor fix RHSA-2009:1177
-
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) python 2.4.3-24.el5_3.6, tkinter 2.4.3-24.el5_3.6, python-tools 2.4.3-24.el5_3.6fixed: vendor fix RHSA-2009:1176
-
Red Hat Enterprise Linux ES version 3 python 2.2.3-6.11, tkinter 2.2.3-6.11, python-tools 2.2.3-6.11fixed: vendor fix RHSA-2009:1178
show 3 moreshow fewer
-
Red Hat Enterprise Linux ES version 4 python 2.3.4-14.7.el4_8.2, tkinter 2.3.4-14.7.el4_8.2, python-tools 2.3.4-14.7.el4_8.2fixed: vendor fix RHSA-2009:1177
-
Red Hat Enterprise Linux WS version 3 python 2.2.3-6.11, tkinter 2.2.3-6.11, python-tools 2.2.3-6.11fixed: vendor fix RHSA-2009:1178
-
Red Hat Enterprise Linux WS version 4 python 2.3.4-14.7.el4_8.2, tkinter 2.3.4-14.7.el4_8.2, python-tools 2.3.4-14.7.el4_8.2fixed: vendor fix RHSA-2009:1177
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
4.38% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- bugs.gentoo.org http://bugs.gentoo.org/attachment.cgi?id=159418&action=view referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-190 Integer Overflow or Wraparound
References
-
bugs.gentoo.org
/attachment.cgi?id=159418&action=view
exploit
-
lists.opensuse.org
/opensuse-security-announce/2008-08/msg00006.html
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/glsa-200807-16.xml
vendor-advisory, third-party-advisory
-
lists.apple.com
/archives/security-announce/2009/Feb/msg00000.html
vendor-advisory, mailing-list
-
ubuntu.com
/usn/usn-632-1
vendor-advisory, third-party-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2008:164
vendor-advisory, broken-link, third-party-advisory
-
debian.org
/security/2008/dsa-1667
vendor-advisory, third-party-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2008:163
vendor-advisory, broken-link, third-party-advisory
-
slackware.com
/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.525289
vendor-advisory, third-party-advisory
-
vupen.com
/english/advisories/2008/2288
vdb-entry, broken-link, third-party-advisory
-
secunia.com
/advisories/32793
third-party-advisory, broken-link
-
exchange.xforce.ibmcloud.com
/vulnerabilities/44173
vdb-entry
-
securityfocus.com
/bid/30491
vdb-entry, third-party-advisory
-
secunia.com
/advisories/38675
third-party-advisory, broken-link
-
secunia.com
/advisories/33937
third-party-advisory, broken-link
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8683
vdb-entry, signature, broken-link
-
secunia.com
/advisories/37471
third-party-advisory, broken-link
-
openwall.com
/lists/oss-security/2008/11/05/3
mailing-list
-
secunia.com
/advisories/31687
third-party-advisory, broken-link
-
openwall.com
/lists/oss-security/2008/11/05/2
mailing-list
-
vmware.com
/security/advisories/VMSA-2009-0016.html
third-party-advisory
-
support.apple.com
/kb/HT3438
third-party-advisory
-
secunia.com
/advisories/31358
third-party-advisory, broken-link
-
secunia.com
/advisories/31332
third-party-advisory, broken-link
-
securityfocus.com
/archive/1/507985/100/0/threaded
mailing-list, third-party-advisory, vdb-entry
-
secunia.com
/advisories/31518
third-party-advisory, broken-link
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9761
vdb-entry, signature, broken-link
-
exchange.xforce.ibmcloud.com
/vulnerabilities/44172
vdb-entry
-
secunia.com
/advisories/31305
third-party-advisory, broken-link
-
bugs.gentoo.org
/show_bug.cgi?id=230640
third-party-advisory
-
secunia.com
/advisories/31365
third-party-advisory, broken-link
-
support.avaya.com
/css/P8/documents/100074697
third-party-advisory
-
novell.com
/support/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5032900
third-party-advisory
-
vupen.com
/english/advisories/2009/3316
vdb-entry, broken-link, third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8445
vdb-entry, signature, broken-link
Sources
- CVE List CVE-2008-2315
- NVD CVE-2008-2315
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.