CVE-2010-2089

Name	CVE-2010-2089
Description	The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-dependent attackers to cause a denial of service (memory corruption and application crash) via crafted arguments, as demonstrated by a call to audioop.reverse with a one-byte string, a different vulnerability than CVE-2010-1634.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	599739

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python2.7 (PTS)	jessie, jessie (lts)	2.7.9-2-ds1-1+deb8u12	fixed
	stretch (security)	2.7.13-2+deb9u6	fixed
	stretch (lts), stretch	2.7.13-2+deb9u9	fixed
	buster	2.7.16-2+deb10u1	fixed
	buster (security)	2.7.16-2+deb10u4	fixed
	bullseye	2.7.18-8+deb11u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
python2.4	source	(unstable)	(unfixed)	low
python2.5	source	(unstable)	2.5.5-10	low	599739
python2.6	source	(unstable)	2.6.5+20100706-1	low
python2.7	source	(unstable)	2.7-1	low
python3.1	source	(unstable)	3.1.2+20100706-1	low

[lenny] - python2.5 <no-dsa> (Minor issue)
[lenny] - python2.4 <no-dsa> (Minor issue)