NVD

Id
5714  
Name
CVE-2008-5983  
Description
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2009-01-27  
Modified Date
2013-05-14  
Seq
2008-5983  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
35167 5714 CVE-2008-5983 FEDORA-2010-9652  View
35168 5714 CVE-2008-5983 GLSA-200903-41  View
35169 5714 CVE-2008-5983 GLSA-200904-06  View
35170 5714 CVE-2008-5983 [debian-bugs] 20081112 Bug#493937: [Patch] Prevent loading of Python modules in working directory  View
35171 5714 CVE-2008-5983 [debian-bugs-rc] 20080805 Bug#484305: bicyclerepair: bike.vim imports untrusted python files from cwd  View
35172 5714 CVE-2008-5983 [oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)  View
35173 5714 CVE-2008-5983 [oss-security] 20090128 Re: CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)  View
35174 5714 CVE-2008-5983 [oss-security] 20090130 Re: CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)  View
35175 5714 CVE-2008-5983 RHSA-2011:0027  View
35176 5714 CVE-2008-5983 USN-1596-1  View
35177 5714 CVE-2008-5983 USN-1613-1  View
35178 5714 CVE-2008-5983 USN-1613-2  View
35179 5714 CVE-2008-5983 USN-1616-1  View
35180 5714 CVE-2008-5983 ADV-2010-1448  View
35181 5714 CVE-2008-5983 ADV-2011-0122  View
35182 5714 CVE-2008-5983 https://bugzilla.redhat.com/show_bug.cgi?id=482814  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41625 JVNDB-2009-002632 Python の PySys_SetArgv API 関数における任意のコードを実行される脆弱性 Python の PySys_SetArgv API 関数には、argv[0] 引数にパスの区切り文字が含まれていない場合、sys.path の先頭に空の文字列を付加するため、任意のコードを実行される脆弱性が存在します。 CVE-2008-5983 36096 CVE-2008-5983 5714 6.9 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002632.html 2009-04-14 2011-02-04 View