Vulnerability Details : CVE-2007-2052
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
Exploit prediction scoring system (EPSS) score for CVE-2007-2052
Probability of exploitation activity in the next 30 days: 4.55%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 92 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2007-2052
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2007-2052
-
Assigned by: nvd@nist.gov (Primary)
-
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2007-2052
-
Red Hat 2007-04-19Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235093 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/
-
http://www.ubuntu.com/usn/usn-585-1
Third Party Advisory
-
http://www.redhat.com/support/errata/RHSA-2007-1076.html
Third Party Advisory
-
http://www.securityfocus.com/bid/23887
Third Party Advisory;VDB Entry
-
http://www.debian.org/security/2008/dsa-1551
Third Party Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11716
Broken Link
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8353
Broken Link
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/34060
VDB Entry
-
http://www.vupen.com/english/advisories/2007/1465
Broken Link;Third Party Advisory
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=416934
Third Party Advisory
-
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
VMSA-2009-0016.6Broken Link;Third Party Advisory
-
http://www.vupen.com/english/advisories/2009/3316
Webmail: access your OVH emails on ovhcloud.com | OVHcloudBroken Link;Third Party Advisory
-
http://www.securityfocus.com/archive/1/469294/30/6450/threaded
Third Party Advisory;VDB Entry
-
http://www.novell.com/linux/security/advisories/2007_13_sr.html
Third Party Advisory
-
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235093
Issue Tracking
-
http://www.debian.org/security/2008/dsa-1620
Third Party Advisory
-
http://www.python.org/download/releases/2.5.1/NEWS.txt
Broken Link;Vendor Advisory
-
http://www.mandriva.com/security/advisories?name=MDKSA-2007:099
Broken Link;Third Party Advisory
-
http://www.trustix.org/errata/2007/0019/
Third Party Advisory
-
http://lists.vmware.com/pipermail/security-announce/2008/000005.html
Third Party Advisory
-
http://www.vupen.com/english/advisories/2008/0637
Broken Link;Third Party Advisory
-
http://www.redhat.com/support/errata/RHSA-2007-1077.html
Third Party Advisory
-
http://www.redhat.com/support/errata/RHSA-2008-0629.html
Third Party Advisory
-
http://www.securityfocus.com/archive/1/507985/100/0/threaded
Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/archive/1/488457/100/0/threaded
Third Party Advisory;VDB Entry
-
https://issues.rpath.com/browse/RPL-1358
Third Party Advisory
- cpe:2.3:a:python:python:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.4.0:*:*:*:*:*:*:*