Python 3.x through 3.9.1 has a buffer overflow in...
Critical severity
Unreviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Jun 2, 2023
Description
Published by the National Vulnerability Database
Jan 19, 2021
Published to the GitHub Advisory Database
May 24, 2022
Last updated
Jun 2, 2023
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
References