CVE-2016-5636

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

• CWE-190

• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
• http://rhn.redhat.com/errata/RHSA-2016-2586.html
• http://www.openwall.com/lists/oss-security/2016/06/15/15Mailing List
• http://www.openwall.com/lists/oss-security/2016/06/16/1Mailing List
• http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
• http://www.securityfocus.com/bid/91247
• http://www.securitytracker.com/id/1038138
• http://www.splunk.com/view/SP-CAAAPSV
• http://www.splunk.com/view/SP-CAAAPUE
• https://bugs.python.org/issue26171Issue Tracking, Patch
• https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5Release Notes
• https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2Release Notes
• https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWSRelease Notes
• https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html
• https://security.gentoo.org/glsa/201701-18
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
• http://rhn.redhat.com/errata/RHSA-2016-2586.html
• http://www.openwall.com/lists/oss-security/2016/06/15/15Mailing List
• http://www.openwall.com/lists/oss-security/2016/06/16/1Mailing List
• http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
• http://www.securityfocus.com/bid/91247
• http://www.securitytracker.com/id/1038138
• http://www.splunk.com/view/SP-CAAAPSV
• http://www.splunk.com/view/SP-CAAAPUE
• https://bugs.python.org/issue26171Issue Tracking, Patch
• https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5Release Notes
• https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2Release Notes
• https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWSRelease Notes
• https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html
• https://security.gentoo.org/glsa/201701-18

Published

Sep 2, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5630Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier…4.9
• CVE-2016-5631Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier…4.9
• CVE-2016-5632Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier…4.9
• CVE-2016-5633Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier…4.9
• CVE-2016-5634Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier…4.9
• CVE-2016-5635Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier…4.9
• CVE-2016-5637The restore_tqb_pixels function in libbpg 0.9.5 through 0.9.…
• CVE-2016-5638There are few web pages associated with the genie app on the…
• CVE-2016-5639Directory traversal vulnerability in cgi-bin/login.cgi on Cr…
• CVE-2016-5640Directory traversal vulnerability in cgi-bin/rftest.cgi on C…
• CVE-2016-5642Opmantek NMIS before 8.5.12G has XSS via SNMP.
• CVE-2016-5645Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L3…7.3