CVE-2007-2052: python Off-by-one Error

Modified

Published 16-04-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-2052 is a medium (CVSS 5.0) Off-by-one Error vulnerability in python. EPSS estimates a 13.64% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 08-05-2007)

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

13.64%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 10 · Related 2

DSA-1551-1 DSA-1620-1 OPENSUSE-SU-2024:11202-1 RHSA-2007:1076 RHSA-2007:1077 RHSA-2008:0264+4 more

Timeline

16-04-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

13.64%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 13.64% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

exploit-databaseremotelinuxVerified
Python 2.5 - 'PyLocale_strxfrm' Remote Information Leak
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-193Off-by-one ErrorA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Python1 product

python2.4.0 | 2.5.0

1 vendor · 1 product

References

38 links

lists.vmware.com/pipermail/security-announce/2008/000005.htmlMailing ListX Refsource MLISTThird Party Advisory
secunia.com/advisories/28050Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/25190Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/25217Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/37471Third Party AdvisoryX Refsource SECUNIA
www.python.org/download/releases/2.5.1/NEWS.txtX Refsource CONFIRMBroken LinkVendor Advisory
bugs.debian.org/cgi-bin/bugreport.cgi?bug=416934X Refsource CONFIRMThird Party Advisory
www.debian.org/security/2008/dsa-1551Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.vmware.com/security/advisories/VMSA-2009-0016.htmlX Refsource CONFIRMBroken LinkThird Party Advisory
secunia.com/advisories/29303Third Party AdvisoryX Refsource SECUNIABroken Link

Show all 38 references

www.vupen.com/english/advisories/2007/1465VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
secunia.com/advisories/29032Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/31492Third Party AdvisoryX Refsource SECUNIABroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8353VDB EntrySignatureX Refsource OVALBroken Link
www.securityfocus.com/archive/1/469294/30/6450/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.redhat.com/support/errata/RHSA-2008-0629.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.redhat.com/support/errata/RHSA-2007-1077.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/archive/1/488457/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.redhat.com/support/errata/RHSA-2007-1076.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/archive/1/507985/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.vupen.com/english/advisories/2008/0637VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235093X Refsource CONFIRMIssue Tracking
secunia.com/advisories/25353Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/25233Third Party AdvisoryX Refsource SECUNIABroken Link
issues.rpath.com/browse/RPL-1358X Refsource CONFIRMThird Party Advisory
www.ubuntu.com/usn/usn-585-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.trustix.org/errata/2007/0019/Vendor AdvisoryX Refsource TRUSTIXThird Party Advisory
secunia.com/advisories/28027Third Party AdvisoryX Refsource SECUNIABroken Link
www.novell.com/linux/security/advisories/2007_13_sr.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
secunia.com/advisories/31255Third Party AdvisoryX Refsource SECUNIABroken Link
www.debian.org/security/2008/dsa-1620Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/25787Third Party AdvisoryX Refsource SECUNIABroken Link
www.securityfocus.com/bid/23887VDB EntryX Refsource BIDThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/34060VDB EntryX Refsource XF
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11716VDB EntrySignatureX Refsource OVALBroken Link
www.vupen.com/english/advisories/2009/3316VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
www.mandriva.com/security/advisories?name=MDKSA-2007:099Vendor AdvisoryX Refsource MANDRIVABroken LinkThird Party Advisory
secunia.com/advisories/29889Third Party AdvisoryX Refsource SECUNIABroken Link