CVE-2007-2052
UnknownEPSS 12.48%
Last modified
CVE-2007-2052 is a vulnerability of currently unknown severity. Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.. EPSS estimates a 12.48% chance of exploitation in the next 30 days.
Description
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Python | Python | 2.4.0 |
| Python | Python | 2.5.0 |
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=416934Third Party Advisory
- http://lists.vmware.com/pipermail/security-announce/2008/000005.htmlThird Party Advisory
- http://secunia.com/advisories/25190Broken Link
- http://secunia.com/advisories/25217Broken Link
- http://secunia.com/advisories/25233Broken Link
- http://secunia.com/advisories/25353Broken Link
- http://secunia.com/advisories/25787Broken Link
- http://secunia.com/advisories/28027Broken Link
- http://secunia.com/advisories/28050Broken Link
- http://secunia.com/advisories/29032Broken Link
- http://secunia.com/advisories/29303Broken Link
- http://secunia.com/advisories/29889Broken Link
- http://secunia.com/advisories/31255Broken Link
- http://secunia.com/advisories/31492Broken Link
- http://secunia.com/advisories/37471Third Party Advisory
- http://www.debian.org/security/2008/dsa-1551Third Party Advisory
- http://www.debian.org/security/2008/dsa-1620Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:099Broken Link, Third Party Advisory
- http://www.novell.com/linux/security/advisories/2007_13_sr.htmlThird Party Advisory
- http://www.python.org/download/releases/2.5.1/NEWS.txtBroken Link, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2007-1076.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2007-1077.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0629.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/469294/30/6450/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/488457/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/507985/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/23887Third Party Advisory, VDB Entry
- http://www.trustix.org/errata/2007/0019/Third Party Advisory
- http://www.ubuntu.com/usn/usn-585-1Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlBroken Link, Third Party Advisory
- http://www.vupen.com/english/advisories/2007/1465Broken Link, Third Party Advisory
- http://www.vupen.com/english/advisories/2008/0637Broken Link, Third Party Advisory
- http://www.vupen.com/english/advisories/2009/3316Broken Link, Third Party Advisory
- https://issues.rpath.com/browse/RPL-1358Third Party Advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=416934Third Party Advisory
- http://lists.vmware.com/pipermail/security-announce/2008/000005.htmlThird Party Advisory
- http://secunia.com/advisories/25190Broken Link
- http://secunia.com/advisories/25217Broken Link
- http://secunia.com/advisories/25233Broken Link
- http://secunia.com/advisories/25353Broken Link
- http://secunia.com/advisories/25787Broken Link
- http://secunia.com/advisories/28027Broken Link
- http://secunia.com/advisories/28050Broken Link
- http://secunia.com/advisories/29032Broken Link
- http://secunia.com/advisories/29303Broken Link
- http://secunia.com/advisories/29889Broken Link
- http://secunia.com/advisories/31255Broken Link
- http://secunia.com/advisories/31492Broken Link
- http://secunia.com/advisories/37471Third Party Advisory
- http://www.debian.org/security/2008/dsa-1551Third Party Advisory
- http://www.debian.org/security/2008/dsa-1620Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:099Broken Link, Third Party Advisory
- http://www.novell.com/linux/security/advisories/2007_13_sr.htmlThird Party Advisory
- http://www.python.org/download/releases/2.5.1/NEWS.txtBroken Link, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2007-1076.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2007-1077.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0629.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/469294/30/6450/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/488457/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/507985/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/23887Third Party Advisory, VDB Entry
- http://www.trustix.org/errata/2007/0019/Third Party Advisory
- http://www.ubuntu.com/usn/usn-585-1Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlBroken Link, Third Party Advisory
- http://www.vupen.com/english/advisories/2007/1465Broken Link, Third Party Advisory
- http://www.vupen.com/english/advisories/2008/0637Broken Link, Third Party Advisory
- http://www.vupen.com/english/advisories/2009/3316Broken Link, Third Party Advisory
- https://issues.rpath.com/browse/RPL-1358Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2007-2052?
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
How severe is CVE-2007-2052?
Severity scoring for CVE-2007-2052 is pending analysis. The EPSS model estimates a 12.48% probability of exploitation in the next 30 days.
How do I fix CVE-2007-2052?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2007
- CVE-2007-2046Multiple CRLF injection vulnerabilities in adclick.php in (a…
- CVE-2007-2047CRLF injection vulnerability in www/delivery/ck.php in Opena…
- CVE-2007-2048Directory traversal vulnerability in /console in the Managem…
- CVE-2007-2049Multiple PHP remote file inclusion vulnerabilities in the Ca…
- CVE-2007-2050Multiple directory traversal vulnerabilities in header.php i…
- CVE-2007-2051Buffer overflow in the parsecmd function in bftpd before 1.8…
- CVE-2007-2053Multiple stack-based buffer overflows in AFFLIB before 2.2.6…
- CVE-2007-2054Multiple format string vulnerabilities in AFFLIB before 2.2.…
- CVE-2007-2055AFFLIB 2.2.8 and earlier allows attackers to execute arbitra…
- CVE-2007-2056Rejected reason: The getlock function in aimage/aimage.cpp i…
- CVE-2007-2057Stack-based buffer overflow in aircrack-ng airodump-ng 0.7 a…
- CVE-2007-2058Directory traversal vulnerability in Acubix PicoZip 4.02 all…
Are you affected by CVE-2007-2052?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST