A vulnerability in IPython could result in execution of arbitrary JavaScript.

Announced

2015-12-17

Revised

2015-12-17

Access

remote

Bugs

#560708

Advisory

https://security.gentoo.org/glsa/201512-02

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-python/ipython	*	< 3.2.1-r1	>= 3.2.1-r1

Background

IPython is an advanced interactive shell for Python.

Description

IPython does not properly check the MIME type of a file.

Impact

A remote attacker could entice a user to open a specially crafted text file using IPython, possibly resulting in execution of arbitrary JavaScript with the privileges of the process.

Workaround

There is no known workaround at this time.

Resolution

All IPython users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-python/ipython-3.2.1-r1"

References

• CVE-2015-7337