Arch Linux Security Advisory ASA-201701-26 ========================================== Severity: Critical Date : 2017-01-15 CVE-ID : CVE-2013-7459 Package : python-crypto Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-118 Summary ======= The package python-crypto before version 2.6.1-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.6.1-5. # pacman -Syu "python-crypto>=2.6.1-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this issue. Impact ====== A remote attacker is able to execute arbitrary code by passing certain parameters to the AES module. References ========== https://github.com/dlitz/pycrypto/issues/176 https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf1... http://seclists.org/oss-sec/2016/q4/760 https://security.archlinux.org/CVE-2013-7459