CVE-2007-2052
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2...
5.0 MediumPublic exploitFix available
CVE-2007-2052 is a medium vulnerability (CVSS 5.0) in Python, published April 16, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.6%, the 96th percentile. Fixed in python2.4 2.4.4-3+etch1.
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
Exploit likelihood
13.6%Down 1.6 points since Feb 4, 2022
What each source reports
NVD Score used
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
- Record
CVE-2007-2052- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-193
- Updated
- 2026-11-02
CVE List No score
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
- Record
CVE-2007-2052- Updated
- 2026-11-02
EUVDEUVD-2007-2047 No score
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
- Record
EUVD-2007-2047- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7hcx-rxp8-j55g No score
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2...
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
- Record
GHSA-7hcx-rxp8-j55g- Weakness
- CWE-193
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11202-1 No score
python-2.7.18-8.1 on GA media
These are all security issues fixed in the python-2.7.18-8.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11202-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0234-1 No score
Security update for python
This update for python fixes the following issues:
Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).
- Record
SUSE-SU-2020:0234-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python2.4Debian:4.0 |
before 2.4.4-3+etch1, plus listed versions 2.4.4-3 |
2.4.4-3+etch1 |
python2.5Debian:4.0 |
before 2.5-5+etch1, plus listed versions 2.5-5 |
2.5-5+etch1 |
pythonRed Hat:enterprise_linux:3::as |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-debuginfoRed Hat:enterprise_linux:3::as |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-develRed Hat:enterprise_linux:3::as |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-toolsRed Hat:enterprise_linux:3::as |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
tkinterRed Hat:enterprise_linux:3::as |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
pythonRed Hat:enterprise_linux:3::desktop |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-develRed Hat:enterprise_linux:3::desktop |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
Show 85 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-toolsRed Hat:enterprise_linux:3::desktop |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
tkinterRed Hat:enterprise_linux:3::desktop |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
pythonRed Hat:enterprise_linux:3::es |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-debuginfoRed Hat:enterprise_linux:3::es |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-develRed Hat:enterprise_linux:3::es |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-toolsRed Hat:enterprise_linux:3::es |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
tkinterRed Hat:enterprise_linux:3::es |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
pythonRed Hat:enterprise_linux:3::ws |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-develRed Hat:enterprise_linux:3::ws |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
python-toolsRed Hat:enterprise_linux:3::ws |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
tkinterRed Hat:enterprise_linux:3::ws |
before 0:2.2.3-6.8 | 0:2.2.3-6.8 |
pythonRed Hat:enterprise_linux:4::as |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-develRed Hat:enterprise_linux:4::as |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-docsRed Hat:enterprise_linux:4::as |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-toolsRed Hat:enterprise_linux:4::as |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
tkinterRed Hat:enterprise_linux:4::as |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
pythonRed Hat:enterprise_linux:4::desktop |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-develRed Hat:enterprise_linux:4::desktop |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-docsRed Hat:enterprise_linux:4::desktop |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-toolsRed Hat:enterprise_linux:4::desktop |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
tkinterRed Hat:enterprise_linux:4::desktop |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
pythonRed Hat:enterprise_linux:4::es |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-develRed Hat:enterprise_linux:4::es |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-docsRed Hat:enterprise_linux:4::es |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-toolsRed Hat:enterprise_linux:4::es |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
tkinterRed Hat:enterprise_linux:4::es |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
pythonRed Hat:enterprise_linux:4::ws |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-develRed Hat:enterprise_linux:4::ws |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-docsRed Hat:enterprise_linux:4::ws |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
python-toolsRed Hat:enterprise_linux:4::ws |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
tkinterRed Hat:enterprise_linux:4::ws |
before 0:2.3.4-14.4.el4_6.1 | 0:2.3.4-14.4.el4_6.1 |
pythonRed Hat:enterprise_linux:2.1::as |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-develRed Hat:enterprise_linux:2.1::as |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-docsRed Hat:enterprise_linux:2.1::as |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-toolsRed Hat:enterprise_linux:2.1::as |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
tkinterRed Hat:enterprise_linux:2.1::as |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
pythonRed Hat:enterprise_linux:2.1::aw |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-develRed Hat:enterprise_linux:2.1::aw |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-docsRed Hat:enterprise_linux:2.1::aw |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-toolsRed Hat:enterprise_linux:2.1::aw |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
tkinterRed Hat:enterprise_linux:2.1::aw |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
pythonRed Hat:enterprise_linux:2.1::es |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-develRed Hat:enterprise_linux:2.1::es |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-docsRed Hat:enterprise_linux:2.1::es |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-toolsRed Hat:enterprise_linux:2.1::es |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
tkinterRed Hat:enterprise_linux:2.1::es |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
pythonRed Hat:enterprise_linux:2.1::ws |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-develRed Hat:enterprise_linux:2.1::ws |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-docsRed Hat:enterprise_linux:2.1::ws |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
python-toolsRed Hat:enterprise_linux:2.1::ws |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
tkinterRed Hat:enterprise_linux:2.1::ws |
before 0:1.5.2-43.72.2 | 0:1.5.2-43.72.2 |
rhn-solaris-bootstrapRed Hat:network_satellite:5.0:el4 |
before 0:5.0.2-3 | 0:5.0.2-3 |
rhn_solaris_bootstrap_5_0_2_3Red Hat:network_satellite:5.0:el4 |
before 0:1-0 | 0:1-0 |
rhn-solaris-bootstrapRed Hat:network_satellite:4.2::el3 |
before 0:5.0.2-3 | 0:5.0.2-3 |
rhn_solaris_bootstrap_5_0_2_3Red Hat:network_satellite:4.2::el3 |
before 0:1-0 | 0:1-0 |
rhn-solaris-bootstrapRed Hat:network_satellite:4.2::el4 |
before 0:5.0.2-3 | 0:5.0.2-3 |
rhn_solaris_bootstrap_5_0_2_3Red Hat:network_satellite:4.2::el4 |
before 0:1-0 | 0:1-0 |
rhn-solaris-bootstrapRed Hat:network_satellite:5.1::el4 |
before 0:5.1.1-3 | 0:5.1.1-3 |
rhn_solaris_bootstrap_5_1_1_3Red Hat:network_satellite:5.1::el4 |
before 0:1-0 | 0:1-0 |
pythonRed Hat:enterprise_linux:5::client_workstation |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
python-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
python-develRed Hat:enterprise_linux:5::client_workstation |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
pythonRed Hat:enterprise_linux:5::client |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
python-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
python-toolsRed Hat:enterprise_linux:5::client |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
tkinterRed Hat:enterprise_linux:5::client |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
pythonRed Hat:enterprise_linux:5::server |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
python-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
python-develRed Hat:enterprise_linux:5::server |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
python-toolsRed Hat:enterprise_linux:5::server |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
tkinterRed Hat:enterprise_linux:5::server |
before 0:2.4.3-24.el5_3.6 | 0:2.4.3-24.el5_3.6 |
pythonSUSE:Linux Enterprise Module for Basesystem 15 |
before 2.7.17-7.32.2 | 2.7.17-7.32.2 |
python-baseSUSE:Linux Enterprise Module for Basesystem 15 |
before 2.7.17-7.32.1 | 2.7.17-7.32.1 |
pythonSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 2.7.17-7.32.2 | 2.7.17-7.32.2 |
python-baseSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 2.7.17-7.32.1 | 2.7.17-7.32.1 |
pythonSUSE:Linux Enterprise Module for Desktop Applications 15 |
before 2.7.17-7.32.2 | 2.7.17-7.32.2 |
pythonSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 |
before 2.7.17-7.32.2 | 2.7.17-7.32.2 |
pythonSUSE:Linux Enterprise Module for Python 2 15 SP1 |
before 2.7.17-7.32.2 | 2.7.17-7.32.2 |
python-baseSUSE:Linux Enterprise Module for Python 2 15 SP1 |
before 2.7.17-7.32.1 | 2.7.17-7.32.1 |
pythonopenSUSE:Tumbleweed |
before 2.7.18-8.1 | 2.7.18-8.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Python 2.5 - 'PyLocale_strxfrm' Remote Information Leak | 2007-05-08 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
lists.vmware.com/pipermail/security-announce/2008/000005.html
secunia.com/advisories/28050
python.org/download/releases/2.5.1/NEWS.txt
Show 194 moreShow less
bugs.debian.org/cgi-bin/bugreport.cgi?bug=416934
debian.org/security/2008/dsa-1551
vmware.com/security/advisories/VMSA-2009-0016.html
vupen.com/english/advisories/2007/1465
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8353
securityfocus.com/archive/1/469294/30/6450/threaded
redhat.com/support/errata/RHSA-2008-0629.html
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235093
issues.rpath.com/browse/RPL-1358
ubuntu.com/usn/usn-585-1
trustix.org/errata/2007/0019
novell.com/linux/security/advisories/2007_13_sr.html
exchange.xforce.ibmcloud.com/vulnerabilities/34060
mandriva.com/security/advisories?name=MDKSA-2007:099
nvd.nist.gov/vuln/detail/CVE-2007-2052
github.com/advisories/GHSA-7hcx-rxp8-j55g
access.redhat.com/errata/RHSA-2007:1076
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_1076.json
cve.org/CVERecord?id=CVE-2006-7228
suse.com/support/update/announcement/2020/suse-su-20200234-1
bugzilla.suse.com/1027282
This page doesn't list everything
Left out here: 68 references. The JSON record has them.