DEBIAN-CVE-2019-12760

A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution...

CVE-2019-12760

The CVE-2019-12760 entry describes a deserialization flaw in parso up to version 0.4.0, where grammar parsing from the cache uses pickle. If an attacker can write a malicious pickle to a cache grammar file and trigger parsing, Arbitrary Code Execution is possible. Note: multiple sources mark this...

CVE-2019-12760

A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution...

PT-2019-12928 · Parso +1 · Parso +1

Name of the Vulnerable Software and Affected Versions: parso versions through 0.4.0 Description: A deserialization vulnerability exists in the way parso handles grammar parsing from the cache. Cache loading relies on pickle, and if an evil pickle can be written to a cache grammar file and its...

Python NumPy Library Command Injection (CVE-2019-6446)

A Command Injection vulnerability exists in Python NumPy library. An authenticated attacker can send a specially crafted pickle file to the affected target host and trigger arbitrary command execution...

Exploit for Deserialization of Untrusted Data in Numpy

CVE-2019-6446: NumPy deserialization command execution NumP...

Fedora Update for PyYAML FEDORA-2019-bed9afe622

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2019:0419-1 Security update for python-numpy

This update for python-numpy fixes the following issue: Security issue fixed: - CVE-2019-6446: Set allowpickle to false by default to restrict loading untrusted content bsc1122208. With this update we decrease the possibility of allowing remote attackers to execute arbitrary code by misusing...

Arbitrary Code Execution

numpy is vulnerable to code execution. It loads pickle by default np.loadallowpickle=True and uses the module in an unsafe way such that it allows an attacker to execute arbitrary code via a malicious serialized object...

CVE-2019-6446

An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have...

UBUNTU-CVE-2019-6446

DISPUTED An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior...

PYSEC-2019-38

DISPUTED An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior...

PYSEC-2019-108

DISPUTED An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior...

PYSEC-2019-108

DISPUTED An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior...

CVE-2019-6446

An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have...

CVE-2019-6446

Removed by vendor...

PT-2019-1615 · Numpy +6 · Numpy +6

Name of the Vulnerable Software and Affected Versions: NumPy versions 1.16.0 and earlier Description: An issue was discovered in NumPy where it uses the pickle Python module unsafely. This allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a...

Arbitrary Code Execution

OpenStack Object Storage swift is vulnerable to arbitrary code execution attack. It unsafely uses python pickle to load and store metadata in memcached,allowing the attacker to execute arbitrary code via a malicious serialized object...

Python Integer Overflow Vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. An integer overflow vulnerability exists in the Modules/pickle.c file in Python versions prior to 3.7.1,...

ALPINE-CVE-2018-20406

Modules/pickle.c in Python before 3.7.1 has an integer overflow via a large LONGBINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of...