CVE-2009-4134

Buffer underflow in the rgbimg module in Python 2.5 allows remote attackers to cause a denial of service (application crash) via a large ZSIZE value in a black-and-white (aka B/W) RGB image that triggers an invalid pointer dereference.

• CWE-787

• http://bugs.python.org/issue8678Patch
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlThird Party Advisory
• http://secunia.com/advisories/42888Broken Link
• http://secunia.com/advisories/43068Broken Link
• http://secunia.com/advisories/43364Broken Link
• http://support.apple.com/kb/HT4435Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:215Broken Link
• http://www.redhat.com/support/errata/RHSA-2011-0027.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2011-0260.htmlThird Party Advisory
• http://www.securityfocus.com/bid/40361Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2011/0122Third Party Advisory
• http://www.vupen.com/english/advisories/2011/0212Third Party Advisory
• http://www.vupen.com/english/advisories/2011/0413Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=541698Issue Tracking, Patch
• http://bugs.python.org/issue8678Patch
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlThird Party Advisory
• http://secunia.com/advisories/42888Broken Link
• http://secunia.com/advisories/43068Broken Link
• http://secunia.com/advisories/43364Broken Link
• http://support.apple.com/kb/HT4435Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:215Broken Link
• http://www.redhat.com/support/errata/RHSA-2011-0027.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2011-0260.htmlThird Party Advisory
• http://www.securityfocus.com/bid/40361Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2011/0122Third Party Advisory
• http://www.vupen.com/english/advisories/2011/0212Third Party Advisory
• http://www.vupen.com/english/advisories/2011/0413Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=541698Issue Tracking, Patch

Published

May 27, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4128GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the…
• CVE-2009-4129Race condition in Mozilla Firefox allows remote attackers to…
• CVE-2009-4130Visual truncation vulnerability in the MakeScriptDialogTitle…
• CVE-2009-4131The EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementatio…
• CVE-2009-4132Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2009-4133Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG…
• CVE-2009-4135The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 t…
• CVE-2009-4136PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x b…
• CVE-2009-4137The loadContentFromCookie function in core/Cookie.php in Piw…
• CVE-2009-4138drivers/firewire/ohci.c in the Linux kernel before 2.6.32-gi…
• CVE-2009-4139A flaw was found in Spacewalk Java site packages. This cross…6.8
• CVE-2009-4140Unrestricted file upload vulnerability in ofc_upload_image.p…