Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2018:2126-1

Опубликовано: 28 июл. 2018
Источник: suse-cvrf

Описание

Security update for python

This update for python fixes the following issues:

The following security vulnerabilities were addressed:

  • Add a check to Lib/wave.py that verifies that at least one channel is provided. Prior to this, attackers could cause a denial of service via a crafted wav format audio file. [bsc#1083507, CVE-2017-18207]

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Список пакетов

openSUSE Leap 42.3
libpython2_7-1_0-2.7.13-27.6.1
libpython2_7-1_0-32bit-2.7.13-27.6.1
python-2.7.13-27.6.1
python-32bit-2.7.13-27.6.1
python-base-2.7.13-27.6.1
python-base-32bit-2.7.13-27.6.1
python-curses-2.7.13-27.6.1
python-demo-2.7.13-27.6.1
python-devel-2.7.13-27.6.1
python-doc-2.7.13-27.6.1
python-doc-pdf-2.7.13-27.6.1
python-gdbm-2.7.13-27.6.1
python-idle-2.7.13-27.6.1
python-tk-2.7.13-27.6.1
python-xml-2.7.13-27.6.1

Ссылки

Описание

** DISPUTED ** The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions."

Затронутые продукты
openSUSE Leap 42.3:libpython2_7-1_0-2.7.13-27.6.1
openSUSE Leap 42.3:libpython2_7-1_0-32bit-2.7.13-27.6.1
openSUSE Leap 42.3:python-2.7.13-27.6.1
openSUSE Leap 42.3:python-32bit-2.7.13-27.6.1
Ссылки