AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

NumPyGHSA-f7c7-j99h-c22f

Buffer Copy without Checking Size of Input in NumPy

NumPy

CVE-2021-41496 · Published Feb 8, 2022 · updated Nov 8, 2023

Medium5.5
Fix: upgrade to 1.19 or later
GitHub advisory

Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values.

Affected versions

PackageAffectedFixed in
numpy
PyPI
< 1.191.19
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-120
Also known as
CVE-2021-41496, PYSEC-2021-857

More NumPy advisories

All NumPy
High 5.5May 14, 2022Arbitrary file write in NumPyCVE-2014-1858fixed in 1.8.1High 5.5May 14, 2022Numpy arbitrary file write via symlink attackCVE-2014-1859fixed in 1.8.1High 7.5May 13, 2022Numpy missing input validationCVE-2017-12852fixed in 1.13.3High 7.5Feb 8, 2022NumPy NULL Pointer DereferenceCVE-2021-41495fixed in 1.19Medium 5.3Jan 7, 2022NumPy Buffer Overflow (Disputed)CVE-2021-33430fixed in 1.21Medium 5.3Dec 18, 2021Incorrect Comparison in NumPyCVE-2021-34141fixed in 1.22