Executive brief
The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
Affected products
- PyPI numpy
Junglewise Threat Intelligence
CVE-2017-12852: PYSEC-2017-1 - The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite
CVE-2017-12852 · Severity: low · CVSS 3 · Published 2017-08-15
Technologies: numpy (PyPI). Vendors: PyPI.
Related threats
- NumPy insecure deserialization in numpy.load
- PYSEC-2021-857 - Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service a
- PYSEC-2021-856 - Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-val
- PYSEC-2021-855 - Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific st
- PYSEC-2021-854 - A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large di