Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:2040-1

Опубликовано: 23 июл. 2018
Источник: suse-cvrf

Описание

Security update for python

This update for python fixes the following issues:

The following security vulnerabilities were addressed:

  • Add a check to Lib/wave.py that verifies that at least one channel is provided. Prior to this, attackers could cause a denial of service via a crafted wav format audio file. [bsc#1083507, CVE-2017-18207]

Список пакетов

SUSE Enterprise Storage 5
python-strict-tls-check-2.7.13-28.6.1
SUSE Linux Enterprise Desktop 12 SP3
libpython2_7-1_0-2.7.13-28.6.1
libpython2_7-1_0-32bit-2.7.13-28.6.1
python-2.7.13-28.6.1
python-base-2.7.13-28.6.1
python-curses-2.7.13-28.6.1
python-devel-2.7.13-28.6.1
python-tk-2.7.13-28.6.1
python-xml-2.7.13-28.6.1
SUSE Linux Enterprise Server 12 SP3
libpython2_7-1_0-2.7.13-28.6.1
libpython2_7-1_0-32bit-2.7.13-28.6.1
python-2.7.13-28.6.1
python-32bit-2.7.13-28.6.1
python-base-2.7.13-28.6.1
python-base-32bit-2.7.13-28.6.1
python-curses-2.7.13-28.6.1
python-demo-2.7.13-28.6.1
python-doc-2.7.13-28.6.1
python-doc-pdf-2.7.13-28.6.1
python-gdbm-2.7.13-28.6.1
python-idle-2.7.13-28.6.1
python-tk-2.7.13-28.6.1
python-xml-2.7.13-28.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
libpython2_7-1_0-2.7.13-28.6.1
libpython2_7-1_0-32bit-2.7.13-28.6.1
python-2.7.13-28.6.1
python-32bit-2.7.13-28.6.1
python-base-2.7.13-28.6.1
python-base-32bit-2.7.13-28.6.1
python-curses-2.7.13-28.6.1
python-demo-2.7.13-28.6.1
python-doc-2.7.13-28.6.1
python-doc-pdf-2.7.13-28.6.1
python-gdbm-2.7.13-28.6.1
python-idle-2.7.13-28.6.1
python-tk-2.7.13-28.6.1
python-xml-2.7.13-28.6.1
SUSE Linux Enterprise Software Development Kit 12 SP3
python-devel-2.7.13-28.6.1
SUSE Linux Enterprise Workstation Extension 12 SP3
python-devel-2.7.13-28.6.1

Ссылки

Описание

** DISPUTED ** The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions."

Затронутые продукты
SUSE Enterprise Storage 5:python-strict-tls-check-2.7.13-28.6.1
SUSE Linux Enterprise Desktop 12 SP3:libpython2_7-1_0-2.7.13-28.6.1
SUSE Linux Enterprise Desktop 12 SP3:libpython2_7-1_0-32bit-2.7.13-28.6.1
SUSE Linux Enterprise Desktop 12 SP3:python-2.7.13-28.6.1
Ссылки