Description of problem:

Modules/_localemodule.c:361
356         n1 = strlen(s) + 1;
357         buf = PyMem_Malloc(n1);
358         if (!buf)
359             return PyErr_NoMemory();
360         n2 = strxfrm(buf, s, n1);

In case the transformed string is longer than original string...
(see the PoC for an exapmle)

361         if (n2 > n1) {
362             /* more space needed */

We allocate n2 bytes here:

363             buf = PyMem_Realloc(buf, n2);
364             if (!buf)
365                 return PyErr_NoMemory();

And here the string will be n2 chars long and terminating NUL won't
fit and thus the string won't be terminated what can lead to an
information leak in certain rare cases (see the original Debian report
for details).

366             strxfrm(buf, s, n2);
367         }
368         result = PyString_FromString(buf);
369         PyMem_Free(buf);
370         return result;
371     }
372
373     #if defined(MS_WINDOWS)
374     static PyObject*
375     PyLocale_getdefaultlocale(PyObject* self)

Version-Release number of selected component (if applicable):

FC5, FC6, RHEL2.1, RHEL3, RHEL4, RHEL5

How reproducible:

Proof of concept code attached.

Additional info:

See the URL for an original bug report to Debian and PoC by Piotr Engelking.
It contains details on how to reproduce and recognize the flaw.