Description
Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | python2.4 | 2.4.4-3+etch1 | DSA-1551-1 |
| Debian 4.0 | python2.5 | 2.5-5+etch1 | DSA-1620-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | python +3 | 2.4.3-24.el5_3.6 | RHSA-2009:1176 |
| RHEL 4 | python +4 | 2.3.4-14.4.el4_6.1 | RHSA-2007:1076 |
| RHEL 3 | python +3 | 2.2.3-6.8 | RHSA-2007:1076 |
| RHEL 2 | python +4 | 1.5.2-43.72.2 | RHSA-2007:1077 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | rhn-solaris-bootstrap | 5.0.2-3 | RHSA-2008:0629, RHSA-2008:0264 |
| Red Hat Network Satellite 5 | rhn_solaris_bootstrap_5_0_2_3 +1 | 1-0 | RHSA-2008:0629, RHSA-2008:0264 |
| Red Hat Network Satellite 4 | rhn-solaris-bootstrap | 5.0.2-3 | RHSA-2008:0525 |
| Red Hat Network Satellite 4 | rhn_solaris_bootstrap_5_0_2_3 | 1-0 | RHSA-2008:0525 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 SP1 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 15 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 2 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 2 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python | 2.7.18-8.1 | openSUSE-SU-2024:11202-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Python 2.5 - 'PyLocale_strxfrm' Remote Information Leak EDB-30018 · remote · May 8, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 10
- RHSA-2009:1176 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1076 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1077 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1551-1 python2.4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1620-1 python2.5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2008:0629 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0525 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0264 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- openSUSE-SU-2024:11202-1 python-2.7.18-8.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2020:0234-1 Security update for python SUSE / openSUSE Security Updates · May 2, 2025
References
- [Security-announce] 20080221 VMSA-2008-0003 Moderate: Updated aacraid driver and samba and python service console updates mailing-list
- 28050 third-party-advisory
- 25190 third-party-advisory
- 25217 third-party-advisory
- 37471 third-party-advisory
- http://www.python.org/download/releases/2.5.1/NEWS.txt
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=416934
- DSA-1551 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 29303 third-party-advisory
- ADV-2007-1465 vdb-entry
- 29032 third-party-advisory
- 31492 third-party-advisory
- oval:org.mitre.oval:def:8353 vdb-entry signature
- 20070521 FLEA-2007-0019-1: python mailing-list
- RHSA-2008:0629 vendor-advisory
- RHSA-2007:1077 vendor-advisory
- 20080221 VMSA-2008-0003 Moderate: Updated aacraid driver and samba and python service console updates mailing-list
- RHSA-2007:1076 vendor-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- ADV-2008-0637 vdb-entry
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235093
- 25353 third-party-advisory
- 25233 third-party-advisory
- https://issues.rpath.com/browse/RPL-1358
- USN-585-1 vendor-advisory
- 2007-0019 vendor-advisory
- 28027 third-party-advisory
- SUSE-SR:2007:013 vendor-advisory
- 31255 third-party-advisory
- DSA-1620 vendor-advisory
- 25787 third-party-advisory
- 23887 vdb-entry
- python-localemodule-information-disclosure(34060) vdb-entry
- oval:org.mitre.oval:def:11716 vdb-entry signature
- ADV-2009-3316 vdb-entry
- MDKSA-2007:099 vendor-advisory
- 29889 third-party-advisory