CVE-2019-6446: Deserialization of Untrusted Data

An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have...

Arbitrary Code Execution

OpenStack Object Storage swift is vulnerable to arbitrary code execution attack. It unsafely uses python pickle to load and store metadata in memcached,allowing the attacker to execute arbitrary code via a malicious serialized object...

Python Integer Overflow Vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. An integer overflow vulnerability exists in the Modules/pickle.c file in Python versions prior to 3.7.1,...

Integer overflow

Modules/pickle.c in Python before 3.7.1 has an integer overflow via a large LONGBINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of...

ALPINE-CVE-2018-20406

Modules/pickle.c in Python before 3.7.1 has an integer overflow via a large LONGBINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of...

CVE-2018-20406

Modules/pickle.c in Python before 3.7.1 has an integer overflow via a large LONGBINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of...

UBUNTU-CVE-2018-20406

Modules/pickle.c in Python before 3.7.1 has an integer overflow via a large LONGBINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of...

PT-2018-3715 · Python +4 · Python +4

Name of the Vulnerable Software and Affected Versions: Python versions prior to 3.7.1 Description: The issue is related to an integer overflow via a large LONG BINPUT value that is mishandled during a "resize to twice the size" attempt in the pickle.c module. This might cause memory exhaustion, b...

Remote Code Execution (RCE)

superset is vulnerable to a remote code execution RCE attack. The library does not properly handle the deserialization of .pickle files, allowing a malicious user to inject and execute arbitrary code through it...

PYSEC-2018-74

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation...

Remote code execution

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation...

CVE-2018-8021

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation...

CVE-2018-8021

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation...

CVE-2018-8021

CVE-2018-8021 concerns Apache Superset pre-0.23, where an unsafe pickle deserialization path can lead to remote code execution. The root cause is the use of an unsafe load method from pickle to deserialize data, enabling an attacker with network access to potentially execute arbitrary code. Multi...

CVE-2018-8021: Deserialization of Untrusted Data

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation...

conference-scheduler-cli Arbitrary Code Execution

In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...

Updated calibre packages fix security vulnerability

Updated calibre package fixes security vulnerability: gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...

Remote Code Execution (RCE)

conference-scheduler-cli is vulnerable to remote code execution RCE attacks. The library does not properly handle the deserialization of .pickle files, allowing a malicious user to inject and execute arbitrary code through it...

pycparser command execution vulnerability

pycparser is a C parser written in Python. A command execution vulnerability exists in pycparser's pickle.load call to import data within the 'readpickle' function of the LRTable class in the yacc.py file. A remote attacker can exploit this vulnerability to execute arbitrary python commands with...

conference-scheduler-cli Command Execution Vulnerability

conference-scheduler-cli is a command line tool for managing conference schedules. A security vulnerability exists in the importscheduledefinition method of the io.py file in conference-scheduler-cli. A remote attacker can exploit this vulnerability to execute arbitrary python commands with the...