CVE-2010-1666 Improper Restriction of Operations within the Bounds of a Memory Buffer in python-cjson
A buffer overflow in python-cjson allows attackers to cause a crash or potentially execute code via crafted Unicode input when UCS-4 encoding is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-1666?
CVE-2010-1666 is a medium-severity memory corruption vulnerability in n/a, published on 2 Jul 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer overflow in Dan Pascu python-cjson 1.0.5, when UCS-4 encoding is enabled, allows context-dependent attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors involving crafted Unicode input to the cjson.encode function.
Weakness: CWE-119
Which versions are affected by CVE-2010-1666?
3 open source packages ship an affected version, including python-cjson. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
python-cjson PyPI | All versions | 1.0.5.1 |
python-cjson PyPI | All versions | 1.0.5.1 |
python-cjson PyPI | All versions | 1.1.0 |
Products include Dan Pascu Python-Cjson.
How do I fix CVE-2010-1666?
Upgrade python-cjson to a fixed version for your release line: 1.0.5.1 or 1.1.0.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2010-1666 being exploited?
There is no known exploitation of CVE-2010-1666 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DSA-2068-1, GHSA-cqmh-mpx2-g633, PYSEC-2010-30, openSUSE-SU-2024:11259-1.