地图 / Python 2.7 strop.replace Integer Overflow

Python 2.7 strop.replace Integer Overflow

内存破坏 / 内存破坏（通用） / #129771

厂商: Internet Bug Bounty
严重程度: 未评级
赏金: $500
弱点: 内存破坏（通用）
研究员: @johnleitch
披露日期: 2016-05-02
资产: Python (Legacy)
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（10275 字符中的一小部分）

I reported this via email a while ago, and I think it slipped through the cracks. This one's nice clean overflow in the strop module, which is deprecated but still available in Python 2.7 and in use.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

2016-04-11报告提交
2016-05-02公开披露

阅读 HackerOne 原文 ↗作者 @johnleitch · 版权归作者与 Internet Bug Bounty 所有

同类报告

Race Conditions in Popular reports feature.HackerOne · 2016-08-03 Malformed .MDL triggers an Access Violation on GoldSRC (hl.exe)Valve · 2019-10-09 [FG-VD-19-009] Intel(R) Trace Analyzer and Collector 2019 Memory Corruption Vulnerability NotificationIntel Corporation · — · $1,500 Type Confusion Vulnerability - SOAP / make_http_soap_request()Internet Bug Bounty · 2019-10-15 · $1,000 Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.Node.js · 2025-05-15 Heap overflow in mysqlnd related to BIT fields (CVE-2016-7412)Internet Bug Bounty · 2019-11-12