Vulnerabilities > CVE-2015-5652 - Remote Code Execution vulnerability in Python DLL Loading 'readline.pyd'

CVSS 7.2 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

local

low complexity

python

microsoft

NVD

Published: 2015-10-06

Updated: 2016-11-28

Summary

Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point." <a href="https://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>

Vulnerable Configurations

Part	Description	Count
Application	Python Python Python - Python Python 0.9.0 Python Python 0.9.1 Python Python 1.2 Python Python 1.3 Python Python 1.5.2 Python Python 1.6 Python Python 1.6.1 Python Python 2.0 Python Python 2.0.1 Python Python 2.1 Python Python 2.1.1 Python Python 2.1.2 Python Python 2.1.3 Python Python 2.2 Python Python 2.2.0 Python Python 2.2.1 Python Python 2.2.2 Python Python 2.2.3 Python Python 2.3 Python Python 2.3.0 Python Python 2.3.1 Python Python 2.3.2 Python Python 2.3.3 Python Python 2.3.4 Python Python 2.3.5 Python Python 2.3.6 Python Python 2.3.7 Python Python 2.4 Python Python 2.4.0 Python Python 2.4.1 Python Python 2.4.2 Python Python 2.4.3 Python Python 2.4.4 Python Python 2.4.5 Python Python 2.4.6 Python Python 2.5 Python Python 2.5.0 Python Python 2.5.1 Python Python 2.5.2 Python Python 2.5.3 Python Python 2.5.4 Python Python 2.5.5 Python Python 2.5.6 Python Python 2.5.150 Python Python 2.6 Python Python 2.6.0 Python Python 2.6.1 Python Python 2.6.2 Python Python 2.6.3 Python Python 2.6.4 Python Python 2.6.5 Python Python 2.6.6 Python Python 2.6.7 Python Python 2.6.8 Python Python 2.6.9 Python Python 2.6.2150 Python Python 2.6.6150 Python Python 2.7 Python Python 2.7.0 Python Python 2.7.1 Python Python 2.7.2 Python Python 2.7.3 Python Python 2.7.4 Python Python 2.7.5 Python Python 2.7.6 Python Python 2.7.7 Python Python 2.7.8 Python Python 2.7.9 Python Python 2.7.10 Python Python 2.7.11 Python Python 2.7.12 Python Python 2.7.13 Python Python 2.7.14 Python Python 2.7.15 Python Python 2.7.16 Python Python 2.7.17 Python Python 2.7.1150 Python Python 2.7.2150 Python Python 3.0 Python Python 3.0.0 Python Python 3.0.1 Python Python 3.1 Python Python 3.1.0 Python Python 3.1.1 Python Python 3.1.2 Python Python 3.1.3 Python Python 3.1.4 Python Python 3.1.5 Python Python 3.1.2150 Python Python 3.2 Python Python 3.2.0 Python Python 3.2.1 Python Python 3.2.2 Python Python 3.2.3 Python Python 3.2.4 Python Python 3.2.5 Python Python 3.2.6 Python Python 3.2.2150 Python Python 3.3 Python Python 3.3.0 Python Python 3.3.1 Python Python 3.3.2 Python Python 3.3.3 Python Python 3.3.4 Python Python 3.3.5 Python Python 3.3.6 Python Python 3.3.7 Python Python 3.4 Python Python 3.4.0 Python Python 3.4.1 Python Python 3.4.2 Python Python 3.4.3 Python Python 3.4.4 Python Python 3.4.5 Python Python 3.4.6 Python Python 3.4.7 Python Python 3.4.8 Python Python 3.4.9 Python Python 3.4.10 Python Python 3.5 Python Python 3.5.0	273
OS	Microsoft Microsoft Windows *	1

Summary

Vulnerable Configurations

References