NumPyGHSA-f7c7-j99h-c22f
Buffer Copy without Checking Size of Input in NumPy
Medium5.5CVE-2021-41496 · Published Feb 8, 2022 · updated Nov 8, 2023
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| numpy PyPI | < 1.19 | 1.19 |
Details and references
Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values.
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-120
- Also known as
- CVE-2021-41496, PYSEC-2021-857
More NumPy advisories
All NumPy| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 82022 | NumPy NULL Pointer Dereference CVE-2021-41495High7.5fixed in 1.19 | High7.5 | 1.19 |
| Jan 72022 | NumPy Buffer Overflow (Disputed) CVE-2021-33430Medium5.3fixed in 1.21 | Medium5.3 | 1.21 |
| Dec 182021 | Incorrect Comparison in NumPy CVE-2021-34141Medium5.3fixed in 1.22 | Medium5.3 | 1.22 |
| May 132022 | Numpy missing input validation CVE-2017-12852High7.5fixed in 1.13.3 | High7.5 | 1.13.3 |
| May 142022 | Numpy arbitrary file write via symlink attack CVE-2014-1859High5.5fixed in 1.8.1 | High5.5 | 1.8.1 |
| May 142022 | Arbitrary file write in NumPy CVE-2014-1858High5.5fixed in 1.8.1 | High5.5 | 1.8.1 |