Skip to content
Fencer Vulns
low 3.7

CVE-2006-1542 json

Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allows local users to c…

published 2006-03-30 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-1546

cvss
3.7
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
1
Exploit-DB

Summary

Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allows local users to cause a "stack overflow," and possibly gain privileges, by running a script from a current working directory that has a long name, related to the realpath function. NOTE: this might not be a vulnerability. However, the fact that it appears in a programming language interpreter could mean that some applications are affected, although attack scenarios might be limited because the attacker might already need to cross privilege boundaries to cause an exploitable program to be placed in a directory with a long name; or, depending on the method that Python uses to determine the current working directory, setuid applications might be affected.

Patch / fix

  • rhn-solaris-bootstrap network satellite 5.1 5.1.1-3
  • rhn_solaris_bootstrap_5_1_1_3 network satellite 5.1 1-0
  • rhn-solaris-bootstrap network satellite 5.0, network satellite 4.2 5.0.2-3
  • rhn_solaris_bootstrap_5_0_2_3 network satellite 5.0, network satellite 4.2 1-0

red hat advisories RHSA-2008:0629RHSA-2008:0525RHSA-2008:0264

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2006-1542 updated

python buffer overflow

  • Red Hat Satellite 5.0 (RHEL v.4 AS) rhn-solaris-bootstrap 5.0.2-3, rhn_solaris_bootstrap_5_0_2_3 1-0
    fixed: vendor fix RHSA-2008:0264
  • Red Hat Satellite 5.1 (RHEL v.4 AS) rhn-solaris-bootstrap 5.1.1-3, rhn_solaris_bootstrap_5_1_1_3 1-0
    fixed: vendor fix RHSA-2008:0629
  • Red Hat Satellite v 4.2 (RHEL v.3 AS) rhn-solaris-bootstrap 5.0.2-3, rhn_solaris_bootstrap_5_0_2_3 1-0 Red Hat Satellite v 4.2 (RHEL v.4 AS) rhn-solaris-bootstrap 5.0.2-3, rhn_solaris_bootstrap_5_0_2_3 1-0
    fixed: vendor fix RHSA-2008:0525

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-1591)
  2. Published

Exploit prediction

0.91% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-1591 Python 2.4.2 - 'realpath()' Local Stack Overflow local, 2006-03-18
  • gotfault.net http://www.gotfault.net/research/exploit/gexp-python.py referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.