Vulnerability in Python
CVE-2007-2052
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.136 (96.4th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.136 · newest: 0.136 · change: 0.000
Affected products
- Python — versions 2.4.0, 2.5.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.vmware.com/pipermail/security-announce/2008/000005.html (mailing-list, Third Party Advisory)
- secunia.com/advisories/28050 (Broken Link, third-party-advisory)
- secunia.com/advisories/25190 (Broken Link, third-party-advisory)
- secunia.com/advisories/25217 (Broken Link, third-party-advisory)
- secunia.com/advisories/37471 (Third Party Advisory, third-party-advisory)
- www.python.org/download/releases/2.5.1/NEWS.txt (Broken Link, Vendor Advisory)
- bugs.debian.org/cgi-bin/bugreport.cgi (Third Party Advisory)
- www.debian.org/security/2008/dsa-1551 (vendor-advisory, Third Party Advisory)
- www.vmware.com/security/advisories/VMSA-2009-0016.html (Third Party Advisory, Broken Link)
- secunia.com/advisories/29303 (Broken Link, third-party-advisory)
Frequently asked questions
- What is CVE-2007-2052?
- CVE-2007-2052 is a vulnerability in Python, classified under Off-by-one Error. Published 2007-04-16.
- Is CVE-2007-2052 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.