p PatchFirst

CVE-2012-3443

CVE-2012-3443

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.

CVSS 7.5 · High · EPSS 2.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-django Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.4.1-1

    Update to 1.4.1-1

  • python-django Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.4.1-1

    Update to 1.4.1-1

  • python-django Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.4.1-1

    Update to 1.4.1-1

  • django PyPI

    Versions
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.1
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.2.4
    • 1.2.5
    • 1.2.6
    • 1.2.7
    • 1.3
    • 1.3.1
    Affected ranges
    • ECOSYSTEM: < 1.3.2

    Update to 1.3.2

  • django PyPI

    Versions
    • 1.4
    Affected ranges
    • ECOSYSTEM: ≥ 1.4, < 1.4.1

    Update to 1.4.1

  • django PyPI

    Versions
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.1
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.2.4
    • 1.2.5
    • 1.2.6
    • 1.2.7
    • 1.3
    • 1.3.1
    • 1.4
    Affected ranges
    • ECOSYSTEM: < 1.3.2 ∪ ≥ 1.4, < 1.4.1

    Update to 1.3.2; Update to 1.4.1

Original sources

Check your server →