← Vulnerability feed

Vulnerability record · CVE-2008-4864 · published 1 November 2008

CVE-2008-4864: Python integer overflow vulnerability

Python · Python

Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Python VM and execute arbitrary code via large integer values in certain arguments to the crop function, leading to a buffer overflow, a different vulnerability than CVE-2007-4965 and CVE-2008-1679.

7.5 CVSS 2.0 High EPSS 21% · top 2.5% CWE-190 · Integer overflow
7.5CVSS 2.0 base score
21%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
34References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Python VM and execute arbitrary code via large integer values in certain arguments to the crop function, leading to a buffer overflow, a different vulnerability than CVE-2007-4965 and CVE-2008-1679.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html Mailing ListThird Party Advisory
http://scary.beasts.org/security/CESA-2008-008.html ExploitThird Party Advisory
http://secunia.com/advisories/33937 Not Applicable
http://secunia.com/advisories/37471 Not Applicable
http://support.apple.com/kb/HT3438 Third Party Advisory
http://svn.python.org/view/python/trunk/Modules/imageop.c?rev=66689&view=diff&r1=66689&r2=66688&p1=python/trunk/Modules/ Permissions Required
http://svn.python.org/view?rev=66689&view=rev Permissions Required
http://www.openwall.com/lists/oss-security/2008/10/27/2 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2008/10/29/3 Mailing ListThird Party Advisory
http://www.securityfocus.com/archive/1/507985/100/0/threaded Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/31932 Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/31976 ExploitThird Party AdvisoryVDB Entry
http://www.vmware.com/security/advisories/VMSA-2009-0016.html Third Party Advisory
http://www.vupen.com/english/advisories/2009/3316 Permissions Required
https://exchange.xforce.ibmcloud.com/vulnerabilities/46606 Third Party AdvisoryVDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10702 Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8354 Broken Link
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html Mailing ListThird Party Advisory
http://scary.beasts.org/security/CESA-2008-008.html ExploitThird Party Advisory
http://secunia.com/advisories/33937 Not Applicable
http://secunia.com/advisories/37471 Not Applicable
http://support.apple.com/kb/HT3438 Third Party Advisory
http://svn.python.org/view/python/trunk/Modules/imageop.c?rev=66689&view=diff&r1=66689&r2=66688&p1=python/trunk/Modules/ Permissions Required
http://svn.python.org/view?rev=66689&view=rev Permissions Required
http://www.openwall.com/lists/oss-security/2008/10/27/2 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2008/10/29/3 Mailing ListThird Party Advisory
http://www.securityfocus.com/archive/1/507985/100/0/threaded Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/31932 Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/31976 ExploitThird Party AdvisoryVDB Entry
http://www.vmware.com/security/advisories/VMSA-2009-0016.html Third Party Advisory
http://www.vupen.com/english/advisories/2009/3316 Permissions Required
https://exchange.xforce.ibmcloud.com/vulnerabilities/46606 Third Party AdvisoryVDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10702 Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8354 Broken Link

Track CVE-2008-4864 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-5031Python vulnerabilityMultiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large integer va…EPSS 3.0%9.8CVE-2022-48565Python xml external entity (xxe) vulnerabilityAn XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist fil…EPSS 5.1%9.8CVE-2022-37454Extended keccak code package project extended keccak code package integer overflow vulnerabilityThe Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute …EPSS 5.8%9.8CVE-2021-29921Python vulnerabilityIn Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) all…EPSS 6.9%9.8CVE-2021-3177Python classic buffer overflow vulnerabilityPython 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applic…EPSS 23%9.8CVE-2020-27619Python vulnerabilityIn Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.EPSS 8.3%9.8CVE-2020-15801Python untrusted search path vulnerabilityIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <execu…EPSS 3.5%9.8CVE-2014-4650Python path traversal vulnerabilityThe CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remo…EPSS 25%

Source: NIST National Vulnerability Database (record CVE-2008-4864), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.