Media

NumPy Buffer Overflow (Disputed)

Publicada: 17.12.2021
Actualizado: 11.10.2026 11:20

A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service.

NOTE: The vendor does not agree this is a vulnerability; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	numpy	>= 1.9.0, < 1.21	1.21

Referencias

Puntuación CVSS 5.3/10

Vector CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Debilidad (CWE): CWE-120
Plataforma: Python (PyPI)
Paquete: numpy
Publicada: 17.12.2021
Actualizado: 11.10.2026 11:20

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2021-854 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-6p56-wp2h-9hxr - CC BY 4.0

Historial de vulnerabilidades: numpy

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Entradas en total: 8
Primera → última: 08.2017 12.2021
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 4
Media 3

Divulgaciones por año

2017: 1
2018: 2
2019: 1
2020: 0
2021: 4
2022: 0
2023: 0
2024: 0
2025: 0
2026: 0

17.12.2021

Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative valu

Media · 5.5 CVE-2021-41496 < 1.19.0 1.19.0
17.12.2021

Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks

Alta · 7.5 CVE-2021-41495 < 1.19.1 1.19.1
17.12.2021

Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.

Media · 5.3 CVE-2021-34141 >= 1.9.0, < 1.10.0 1.10.0
17.12.2021

NumPy Buffer Overflow (Disputed) esta entrada

Media · 5.3 CVE-2021-33430 >= 1.9.0, < 1.21 1.21
16.01.2019

Numpy Deserialization of Untrusted Data

Crítica · 9.8 CVE-2019-6446 < 1.16.3 1.16.3
08.01.2018

Numpy arbitrary file write via symlink attack

Alta · 5.5 CVE-2014-1859 < 1.8.1 1.8.1
08.01.2018

Arbitrary file write in NumPy

Alta · 5.5 CVE-2014-1858 < 1.8.1 1.8.1
15.08.2017

The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.

Alta · 7.5 CVE-2017-12852 < 1.13.3 1.13.3

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación