[Bug 1916480] Re: CVE-2021-3177: buffer overflow when parsing floats

[Nanush]

** Also affects: python3.8 (Ubuntu)
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to python3.6 in Ubuntu.
https://bugs.launchpad.net/bugs/1916480

Title:
  CVE-2021-3177: buffer overflow when parsing floats

Status in python3.6 package in Ubuntu:
  Confirmed
Status in python3.8 package in Ubuntu:
  Confirmed

Bug description:
  Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution in certain
  Python applications that accept floating-point numbers as untrusted
  input, as demonstrated by a 1e300 argument to c_double.from_param.
  This occurs because sprintf is used unsafely.

  See also https://ubuntu.com/security/CVE-2021-3177.

  Fixed in 3.6.13.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python3.6/+bug/1916480/+subscriptions