{"id":"PSF-2012-6","summary":"Vulnerability in the utf-16 decoder after error handling","details":"The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors.","aliases":["CVE-2012-2135"],"modified":"2025-10-09T00:57:36.111040Z","published":"2012-08-14T22:00:00Z","database_specific":{"cwe_ids":[]},"references":[{"type":"REPORT","url":"https://bugs.python.org/issue14579"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"0"},{"fixed":"715a63b78349952ccc0fb3dd3139e2d822006d35"},{"fixed":"b4bbee25b1e3f4bccac222f806b3138fb72439d6"}]}],"versions":["2.5","v0.9.8","v0.9.9","v1.0.1","v1.0.2","v1.1","v1.1.1","v1.2","v1.2b1","v1.2b2","v1.2b3","v1.2b4","v1.3","v1.3b1","v1.4","v1.4b1","v1.4b2","v1.4b3","v1.5","v1.5.1","v1.5.2","v1.5.2a1","v1.5.2a2","v1.5.2b1","v1.5.2b2","v1.5.2c1","v1.5a1","v1.5a2","v1.5a3","v1.5a4","v1.5b1","v1.5b2","v1.6a1","v1.6a2","v2.0","v2.0b1","v2.0b2","v2.0c1","v2.1","v2.1a1","v2.1a2","v2.1b1","v2.1b2","v2.1c1","v2.1c2","v2.2a3","v2.3c1","v2.3c2","v2.4","v2.4a1","v2.4a2","v2.4a3","v2.4b1","v2.4b2","v2.4c1","v2.5","v2.5.1","v2.5.1c1","v2.5.2","v2.5.2c1","v2.5.3","v2.5.3c1","v2.5.4","v2.5.5","v2.5.5c1","v2.5.5c2","v2.5.6","v2.5.6c1","v2.5a0","v2.5a1","v2.5a2","v2.5b1","v2.5b2","v2.5b3","v2.5c1","v2.5c2","v2.6","v2.6.1","v2.6.2","v2.6.2c1","v2.6.3","v2.6.3rc1","v2.6.4","v2.6.4rc1","v2.6.4rc2","v2.6.5","v2.6.5rc1","v2.6.5rc2","v2.6.6","v2.6.6rc1","v2.6.6rc2","v2.6.7","v2.6.8","v2.6.8rc1","v2.6.8rc2","v2.6a1","v2.6a2","v2.6a3","v2.6b1","v2.6b2","v2.6b3","v2.6rc1","v2.6rc2","v2.7","v2.7.1","v2.7.1rc1","v2.7.2","v2.7.2rc1","v2.7.3","v2.7.3rc1","v2.7.3rc2","v2.7a1","v2.7a2","v2.7a3","v2.7a4","v2.7b1","v2.7b2","v2.7rc1","v2.7rc2"],"database_specific":{"source":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2012-6.json","vanir_signatures":[{"id":"PSF-2012-6-04a948c5","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/715a63b78349952ccc0fb3dd3139e2d822006d35","target":{"file":"Objects/unicodeobject.c"},"deprecated":false,"digest":{"line_hashes":["77494284213508312052507397711133163586","30806758719947998487129044887749264242","203366887679185723305577288738612810987","105876085667305864668651171667032818981"],"threshold":0.9}},{"digest":{"line_hashes":["165844190008975069712553340698872190936","245897025504651289261113700743353006929","164854537525224905288953051679758517629","291984642916331106058846634598886242432","50169221587702496264495002002897038912","164147420397122152913582262389002589808","57160220024913791209374029041787450775","332374660219934258666062435584255162813","80910501957713297644877656464099344798","338542055379720399115105443035006550362","265121188902807983996067249986765932642","158053233666429378285982798840787214583","253163290355035482207048534699352261353","68492468683141535834108614760712042905","17821435917437956688473928186382427001","170473605874361382511573245345388531530","202890645637614026262971475624558266958","267907126879349388823196516931657388484","68900991534646639698144392606070395330","256390306608142115759009881073416753470","233013770943082266588971712296670031157","54509061804357986290942462556418691342","262130273377363789577347465282622711913","154062711258981944996321351676793271328","42621504727512583172973859583369447264","207774792670407595782000259352125940948","129279224619668629836869633592712339796","32403682606205744779488227920330599800","133584572493934171707917617383263857417","166898234993255645495097679863489600388","237979303760912724848309739929391382976","32616809297223401351156960678240271461","304868938254431693866679396895629422192","36266387123631911751650170013857333973","328586746968421802521081593114933673798","232641998035144466397518376950199788145","73474880666312939095000384367925001101","225991497188082315817720916378152757866","95805668484640174581692812964489052776","217409550157864117617425384686759750685","303949675149642035642638360288021083158","294425763778668853335509820007276050865","54509061804357986290942462556418691342","252645316857192675615383829419933630797","261660632103313594228445199870822234572","160991405832813485313269032528463313519"],"threshold":0.9},"id":"PSF-2012-6-2a9c562a","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/b4bbee25b1e3f4bccac222f806b3138fb72439d6","target":{"file":"Objects/unicodeobject.c"},"deprecated":false},{"target":{"function":"PyUnicode_DecodeUTF16Stateful","file":"Objects/unicodeobject.c"},"deprecated":false,"digest":{"function_hash":"230354985645856854839500274717628464585","length":4528},"id":"PSF-2012-6-a3528b57","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/b4bbee25b1e3f4bccac222f806b3138fb72439d6"},{"source":"https://github.com/python/cpython/commit/715a63b78349952ccc0fb3dd3139e2d822006d35","target":{"file":"Objects/unicodeobject.c","function":"PyUnicode_DecodeUTF16Stateful"},"deprecated":false,"digest":{"function_hash":"36597964745776856491724274803083671869","length":2552},"id":"PSF-2012-6-e2e96cb7","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.7.3"}