Description
Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the (1) stringobject, (2) unicodeobject, (3) bufferobject, (4) longobject, (5) tupleobject, (6) stropmodule, (7) gcmodule, and (8) mmapmodule modules. NOTE: The expandtabs integer overflows in stringobject and unicodeobject in 2.5.2 are covered by CVE-2008-5031.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | python2.5 | 2.5.2-6+lenny1 | DTSA-157-1 |
| Debian 4.0 | python2.4 | 2.4.4-3+etch2 | DSA-1667-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | python +3 | 2.4.3-24.el5_3.6 | RHSA-2009:1176 |
| RHEL 4 | python +4 | 2.3.4-14.7.el4_8.2 | RHSA-2009:1177 |
| RHEL 3 | python +3 | 2.2.3-6.11 | RHSA-2009:1178 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 SP1 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 15 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 2 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 2 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python | 2.7.18-8.1 | openSUSE-SU-2024:11202-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
Advisories 7
- RHSA-2009:1176 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1178 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1177 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1667-1 python2.4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-157-1 python2.5 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11202-1 python-2.7.18-8.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2020:0234-1 Security update for python SUSE / openSUSE Security Updates · May 2, 2025
References
- SUSE-SR:2008:017 vendor-advisory
- ADV-2008-2288 vdb-entry
- 32793 third-party-advisory
- python-multiple-bo(44173) vdb-entry
- 30491 vdb-entry
- 38675 third-party-advisory
- 33937 third-party-advisory
- oval:org.mitre.oval:def:8683 vdb-entry signature
- 37471 third-party-advisory
- [oss-security] 20081105 Re: CVE Request - Python string expandtabs mailing-list
- 31687 third-party-advisory
- [oss-security] 20081105 CVE Request - Python string expandtabs mailing-list
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- GLSA-200807-16 vendor-advisory
- http://support.apple.com/kb/HT3438
- APPLE-SA-2009-02-12 vendor-advisory
- 31358 third-party-advisory
- 31332 third-party-advisory
- USN-632-1 vendor-advisory
- MDVSA-2008:164 vendor-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 31518 third-party-advisory
- oval:org.mitre.oval:def:9761 vdb-entry signature
- python-modules-bo(44172) vdb-entry
- 31305 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=230640
- 31365 third-party-advisory
- http://support.avaya.com/css/P8/documents/100074697
- http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5032900
- http://bugs.gentoo.org/attachment.cgi?id=159418&action=view
- DSA-1667 vendor-advisory
- MDVSA-2008:163 vendor-advisory
- SSA:2008-217-01 vendor-advisory
- ADV-2009-3316 vdb-entry
- oval:org.mitre.oval:def:8445 vdb-entry signature