Description
Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and a buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | python2.4 | 2.4.4-3+etch1 | DSA-1551-1 |
| Debian 4.0 | python2.5 | 2.5-5+etch1 | DSA-1620-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | python +3 | 2.4.3-24.el5_3.6 | RHSA-2009:1176 |
| RHEL 4 | python +4 | 2.3.4-14.7.el4_8.2 | RHSA-2009:1177 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 SP1 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 15 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 2 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 2 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python | 2.7.18-8.1 | openSUSE-SU-2024:11202-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Python zlib Module - Remote Buffer Overflow EDB-31634 · remote · Apr 9, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2009:1176 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1177 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1551-1 python2.4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1620-1 python2.5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11202-1 python-2.7.18-8.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2020:0234-1 Security update for python SUSE / openSUSE Security Updates · May 2, 2025
References
- GLSA-200807-01 vendor-advisory
- ADV-2008-1229 vdb-entry
- 30872 third-party-advisory
- 28715 vdb-entry
- 38675 third-party-advisory
- 33937 third-party-advisory
- MDVSA-2008:085 vendor-advisory
- 37471 third-party-advisory
- 29955 third-party-advisory
- DSA-1551 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://support.apple.com/kb/HT3438
- APPLE-SA-2009-02-12 vendor-advisory
- 31358 third-party-advisory
- zlib-pystringfromstringandsize-bo(41748) vdb-entry
- USN-632-1 vendor-advisory
- 1019823 vdb-entry
- http://bugs.python.org/issue2586
- https://issues.rpath.com/browse/RPL-2444
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 3802 third-party-advisory
- 31365 third-party-advisory
- oval:org.mitre.oval:def:8249 vdb-entry signature
- http://support.avaya.com/css/P8/documents/100074697
- 31255 third-party-advisory
- 20080409 IOActive Security Advisory: Buffer overflow in Python zlib extension module mailing-list
- DSA-1620 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0149
- oval:org.mitre.oval:def:9407 vdb-entry signature
- SSA:2008-217-01 vendor-advisory
- ADV-2009-3316 vdb-entry
- 29889 third-party-advisory
- oval:org.mitre.oval:def:8494 vdb-entry signature