Lucene search

K

[email protected]NVD:CVE-2012-3444

HistoryJul 31, 2012 - 5:55 p.m.

CVE-2012-3444

2012-07-3117:55:04

CWE-119

[email protected]

web.nvd.nist.gov

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

6.3 Medium

AI Score

Confidence

Low

0.02 Low

EPSS

Percentile

88.9%

The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image.

Affected configurations

NVD

Node

djangoprojectdjangoRange≤1.3

OR

djangoprojectdjangoMatch0.95

OR

djangoprojectdjangoMatch0.96

OR

djangoprojectdjangoMatch1.0

OR

djangoprojectdjangoMatch1.0alpha1

OR

djangoprojectdjangoMatch1.0alpha2

OR

djangoprojectdjangoMatch1.0beta

OR

djangoprojectdjangoMatch1.0beta2

OR

djangoprojectdjangoMatch1.0.1

OR

djangoprojectdjangoMatch1.0.2

OR

djangoprojectdjangoMatch1.1

OR

djangoprojectdjangoMatch1.1alpha1

OR

djangoprojectdjangoMatch1.1beta1

OR

djangoprojectdjangoMatch1.1rc1

OR

djangoprojectdjangoMatch1.1.2

OR

djangoprojectdjangoMatch1.1.3

OR

djangoprojectdjangoMatch1.1.4

OR

djangoprojectdjangoMatch1.2

OR

djangoprojectdjangoMatch1.2beta1

OR

djangoprojectdjangoMatch1.2rc1

OR

djangoprojectdjangoMatch1.2-alpha1

OR

djangoprojectdjangoMatch1.2.2

OR

djangoprojectdjangoMatch1.2.4

OR

djangoprojectdjangoMatch1.2.5

OR

djangoprojectdjangoMatch1.2.6

OR

djangoprojectdjangoMatch1.2.7

OR

djangoprojectdjangoMatch1.3alpha1

OR

djangoprojectdjangoMatch1.3beta1

OR

djangoprojectdjangoMatch1.4

References

www.debian.org/security/2012/dsa-2529

www.mandriva.com/security/advisories?name=MDVSA-2012:143

www.openwall.com/lists/oss-security/2012/07/31/1

www.openwall.com/lists/oss-security/2012/07/31/2

www.ubuntu.com/usn/USN-1560-1

www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

6.3 Medium

AI Score

Confidence

Low

0.02 Low

EPSS

Percentile

88.9%

Related for NVD:CVE-2012-3444

gitlab1 cvelist1 cve1 ubuntucve1 prion1 debiancve1 osv3 github1 openvas20 debian1 fedora6 securityvulns2 nessus7 seebug1 ubuntu1 freebsd1