Mandriva Linux Security Advisory : python (MDVSA-2014:135)
Low Nessus Plugin ID 76471
SynopsisThe remote Mandriva Linux host is missing one or more security updates.
DescriptionUpdated python and python-simplejson package fixes security vulnerability
Python are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616).
This issue also affected the python-simplejson package, which has been patched to fix the bug.
SolutionUpdate the affected packages.