Security update for python3 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:0966-1 Final 1 1 2018-04-16T19:12:47Z current 2018-04-16T19:12:47Z 2018-04-16T19:12:47Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python3 This update for python3 fixes the following issues: Security issue fixed: - CVE-2017-18207: Fixed possible denial of service vulnerability by adding a check to Lib/wave.py that verifies that at least one channel is provided (bsc#1083507). This update was imported from the SUSE:SLE-12:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2018-04/msg00041.html E-Mail link for openSUSE-SU-2018:0966-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 libpython3_4m1_0-3.4.6-12.3.1 libpython3_4m1_0-32bit-3.4.6-12.3.1 python3-3.4.6-12.3.1 python3-32bit-3.4.6-12.3.1 python3-base-3.4.6-12.3.1 python3-base-32bit-3.4.6-12.3.1 python3-curses-3.4.6-12.3.1 python3-dbm-3.4.6-12.3.1 python3-devel-3.4.6-12.3.1 python3-doc-3.4.6-12.3.2 python3-doc-pdf-3.4.6-12.3.2 python3-idle-3.4.6-12.3.1 python3-testsuite-3.4.6-12.3.1 python3-tk-3.4.6-12.3.1 python3-tools-3.4.6-12.3.1 libpython3_4m1_0-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 libpython3_4m1_0-32bit-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-32bit-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-base-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-base-32bit-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-curses-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-dbm-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-devel-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-doc-3.4.6-12.3.2 as a component of openSUSE Leap 42.3 python3-doc-pdf-3.4.6-12.3.2 as a component of openSUSE Leap 42.3 python3-idle-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-testsuite-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-tk-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 python3-tools-3.4.6-12.3.1 as a component of openSUSE Leap 42.3 ** DISPUTED ** The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions." CVE-2017-18207 openSUSE Leap 42.3:libpython3_4m1_0-3.4.6-12.3.1 openSUSE Leap 42.3:libpython3_4m1_0-32bit-3.4.6-12.3.1 openSUSE Leap 42.3:python3-3.4.6-12.3.1 openSUSE Leap 42.3:python3-32bit-3.4.6-12.3.1 openSUSE Leap 42.3:python3-base-3.4.6-12.3.1 openSUSE Leap 42.3:python3-base-32bit-3.4.6-12.3.1 openSUSE Leap 42.3:python3-curses-3.4.6-12.3.1 openSUSE Leap 42.3:python3-dbm-3.4.6-12.3.1 openSUSE Leap 42.3:python3-devel-3.4.6-12.3.1 openSUSE Leap 42.3:python3-doc-3.4.6-12.3.2 openSUSE Leap 42.3:python3-doc-pdf-3.4.6-12.3.2 openSUSE Leap 42.3:python3-idle-3.4.6-12.3.1 openSUSE Leap 42.3:python3-testsuite-3.4.6-12.3.1 openSUSE Leap 42.3:python3-tk-3.4.6-12.3.1 openSUSE Leap 42.3:python3-tools-3.4.6-12.3.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-04/msg00041.html https://www.suse.com/security/cve/CVE-2017-18207.html CVE-2017-18207 https://bugzilla.suse.com/1083507 SUSE Bug 1083507