CVE-2014-4616

CVE-2014-4616 affects Python’s json implementation: the scanstring function in the _json module (and in simplejson prior to 2.6.1) has an array index error that can be triggered by a negative idx in raw_decode. Affected: Python 2.7–3.5 and simplejson