Vulnerability in Python

CVE-2007-2052

Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.

EPSS: 0.125 (95.8th percentile) — read the EPSS interpretation.

Affected products

  • Python — versions 2.4.0, 2.5.0
  • N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

References

  • cve@mitre.org (mailing-list, x_refsource_MLIST, Third Party Advisory)
  • cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
  • cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
  • cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
  • cve@mitre.org (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
  • cve@mitre.org (x_refsource_CONFIRM, Broken Link, Vendor Advisory)
  • cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
  • cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
  • cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory, Broken Link)
  • cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)

Frequently asked questions

What is CVE-2007-2052?
CVE-2007-2052 is a vulnerability in Python, classified under Off-by-one Error. Published 2007-04-16.
Is CVE-2007-2052 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.