{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2014-4616","sourceIdentifier":"cve@mitre.org","published":"2017-08-24T20:29:00.173","lastModified":"2026-06-17T00:10:20.837","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function."},{"lang":"es","value":"Un error de índice de matriz en la función scanstring en el módulo the _json en Python 2.7 en su versión 3.5 y simplejson en su versión 2.6.1 permite que atacantes dependientes del contexto lean archivos arbitrarios de la memoria de proceso mediante un valor de índice negativo en el argumento idx en la función raw_decode function."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-129"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","versionStartIncluding":"2.7.0","versionEndExcluding":"2.7.7","matchCriteriaId":"D2D3226A-D2F3-4903-B188-71FBF80E06F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.2.6","matchCriteriaId":"E734E216-BD2E-4093-87AE-25F1D608D39A"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3.0","versionEndExcluding":"3.3.6","matchCriteriaId":"EE8A640D-5595-4E52-B191-4941EAB75258"},{"vulnerable":true,"criteria":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.0","versionEndExcluding":"3.4.1","matchCriteriaId":"C90347E4-1932-4664-BC5D-25DE1C4D59D8"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:simplejson_project:simplejson:*:*:*:*:*:python:*:*","versionEndExcluding":"2.6.1","matchCriteriaId":"D0A9DE12-0F04-47A2-9504-671DBA5F69B0"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*","matchCriteriaId":"A10BC294-9196-425F-9FB0-B1625465B47F"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse_project:opensuse:12.3:*:*:*:*:*:*:*","matchCriteriaId":"1B91DE6A-D759-4B2C-982B-AF036B43798D"}]}]}],"references":[{"url":"http://bugs.python.org/issue21529","source":"cve@mitre.org","tags":["Issue Tracking","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-07/msg00015.html","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://openwall.com/lists/oss-security/2014/06/24/7","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1064.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/68119","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752395","source":"cve@mitre.org","tags":["Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1112285","source":"cve@mitre.org","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/12297","source":"cve@mitre.org","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201503-10","source":"cve@mitre.org","tags":["Patch","Third Party Advisory","VDB Entry"]},{"url":"http://bugs.python.org/issue21529","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-07/msg00015.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://openwall.com/lists/oss-security/2014/06/24/7","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1064.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/68119","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752395","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1112285","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/12297","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201503-10","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory","VDB Entry"]}]}}