{"api_version":"1","generated_at":"2026-07-23T05:16:23+00:00","cve":"CVE-2007-2452","urls":{"html":"https://cve.report/CVE-2007-2452","api":"https://cve.report/api/cve/CVE-2007-2452.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-2452","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-2452"},"summary":{"title":"CVE-2007-2452","description":"Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036.","state":"PUBLISHED","assigner":"redhat","published_at":"2007-06-04 16:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6","severity":"","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:P/A:P","baseScore":6,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2007/2015","name":"http://www.vupen.com/english/advisories/2007/2015","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/2760","name":"http://securityreason.com/securityalert/2760","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"GNU Findutils release 4.2.31 fixes CVE-2007-2452 (GNU locate heap buffer overrun) - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/34628","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/34628","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/24250","name":"http://www.securityfocus.com/bid/24250","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"GNU Locate Old Format Locate Database Local Buffer Overflow Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/470108/100/0/threaded","name":"http://www.securityfocus.com/archive/1/470108/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1018183","name":"http://www.securitytracker.com/id?1018183","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"GNU locate Filename Buffer Overflow Lets Local Users Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://secunia.com/advisories/40551","name":"http://secunia.com/advisories/40551","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"HP Insight Control Suite For Linux Multiple Vulnerabilities - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083","name":"http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://secunia.com/advisories/25477","name":"http://secunia.com/advisories/25477","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"GNU findutils locate Long Path Buffer Overflow Vulnerability - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2010/1796","name":"http://www.vupen.com/english/advisories/2010/1796","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/36827","name":"http://osvdb.org/36827","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-2452","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2452","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"2452","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnu","cpe5":"findutils","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2452","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnu","cpe5":"findutils","cpe6":"4.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2452","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnu","cpe5":"findutils","cpe6":"4.2.28","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2452","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnu","cpe5":"findutils","cpe6":"4.2.29","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2452","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnu","cpe5":"findutils","cpe6":"4.2.30","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[{"cvename":"CVE-2007-2452","organization":"Red Hat","lastmodified":"2007-06-11","contributor":"Mark J Cox","statementText":"Not vulnerable. Red Hat did not ship GNU locate in Red Hat Enterprise Linux 2.1, 3, 4, or 5. This issue does not affect the ’mlocate’ or ’slocate’ packages that are supplied with Red Hat Enterprise Linux.","cve_year":"2007","cve_id":"2452","crc32":"6bb4f897"}],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T13:42:33.417Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"SSRT100018","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"},{"name":"findutils-filename-bo(34628)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/34628"},{"name":"HPSBMA02554","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"},{"name":"ADV-2007-2015","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/2015"},{"name":"40551","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/40551"},{"name":"36827","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/36827"},{"name":"20070530 GNU Findutils release 4.2.31 fixes CVE-2007-2452 (GNU locate heap buffer overrun)","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/470108/100/0/threaded"},{"name":"25477","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/25477"},{"name":"2760","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/2760"},{"name":"ADV-2010-1796","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2010/1796"},{"name":"1018183","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1018183"},{"name":"24250","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/24250"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-05-30T00:00:00.000Z","descriptions":[{"lang":"en","value":"Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-16T14:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"SSRT100018","tags":["vendor-advisory","x_refsource_HP"],"url":"http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"},{"name":"findutils-filename-bo(34628)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/34628"},{"name":"HPSBMA02554","tags":["vendor-advisory","x_refsource_HP"],"url":"http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"},{"name":"ADV-2007-2015","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/2015"},{"name":"40551","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/40551"},{"name":"36827","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/36827"},{"name":"20070530 GNU Findutils release 4.2.31 fixes CVE-2007-2452 (GNU locate heap buffer overrun)","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/470108/100/0/threaded"},{"name":"25477","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/25477"},{"name":"2760","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/2760"},{"name":"ADV-2010-1796","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2010/1796"},{"name":"1018183","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1018183"},{"name":"24250","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/24250"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2007-2452","datePublished":"2007-06-04T16:00:00.000Z","dateReserved":"2007-05-02T00:00:00.000Z","dateUpdated":"2024-08-07T13:42:33.417Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-06-04 16:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:P/A:P","baseScore":6,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gnu:findutils:4.0:*:*:*:*:*:*:*","matchCriteriaId":"7CA98BAA-CDE7-4255-B4A9-926CA2BF9783"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnu:findutils:4.1:*:*:*:*:*:*:*","matchCriteriaId":"82F0B7F9-8A8E-4717-9C78-A26141AC66BC"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnu:findutils:4.2.28:*:*:*:*:*:*:*","matchCriteriaId":"F259F661-06F3-48A9-96B5-C50A3D96E441"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnu:findutils:4.2.29:*:*:*:*:*:*:*","matchCriteriaId":"B462C06B-B665-4B56-9A93-3F96C328C72A"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnu:findutils:4.2.30:*:*:*:*:*:*:*","matchCriteriaId":"CC81E4F7-6889-490C-9F11-79A5D693F695"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"2452","Ordinal":"1","Title":"CVE-2007-2452","CVE":"CVE-2007-2452","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"2452","Ordinal":"1","NoteData":"Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036.","Type":"Description","Title":"CVE-2007-2452"},{"CveYear":"2007","CveId":"2452","Ordinal":"2","NoteData":"2007-06-04","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"2452","Ordinal":"3","NoteData":"2018-10-16","Type":"Other","Title":"Modified"}]}}}