Security update for python3 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0934-1 Final 1 1 2018-04-12T16:02:42Z current 2018-04-12T16:02:42Z 2018-04-12T16:02:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python3 This update for python3 fixes the following issues: Security issue fixed: - CVE-2017-18207: Fixed possible denial of service vulnerability by adding a check to Lib/wave.py that verifies that at least one channel is provided (bsc#1083507). Bug fixes: - Require python-Sphinx-latex for building on Leap 42.3 or newer. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP3-2018-632,SUSE-SLE-Module-Web-Scripting-12-2018-632,SUSE-SLE-SDK-12-SP3-2018-632,SUSE-SLE-SERVER-12-SP3-2018-632 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180934-1/ Link for SUSE-SU-2018:0934-1 https://lists.suse.com/pipermail/sle-security-updates/2018-April/003890.html E-Mail link for SUSE-SU-2018:0934-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1083507 SUSE Bug 1083507 https://www.suse.com/security/cve/CVE-2017-18207/ SUSE CVE CVE-2017-18207 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 libpython3_4m1_0-3.4.6-25.7.1 python3-3.4.6-25.7.1 python3-base-3.4.6-25.7.1 python3-curses-3.4.6-25.7.1 python3-devel-3.4.6-25.7.1 libpython3_4m1_0-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python3-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python3-base-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python3-curses-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libpython3_4m1_0-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 python3-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 python3-base-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 libpython3_4m1_0-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 python3-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 python3-base-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 python3-curses-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 libpython3_4m1_0-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python3-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python3-base-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python3-curses-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python3-devel-3.4.6-25.7.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 ** DISPUTED ** The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions." CVE-2017-18207 SUSE Linux Enterprise Desktop 12 SP3:libpython3_4m1_0-3.4.6-25.7.1 SUSE Linux Enterprise Desktop 12 SP3:python3-3.4.6-25.7.1 SUSE Linux Enterprise Desktop 12 SP3:python3-base-3.4.6-25.7.1 SUSE Linux Enterprise Desktop 12 SP3:python3-curses-3.4.6-25.7.1 SUSE Linux Enterprise Module for Web and Scripting 12:libpython3_4m1_0-3.4.6-25.7.1 SUSE Linux Enterprise Module for Web and Scripting 12:python3-3.4.6-25.7.1 SUSE Linux Enterprise Module for Web and Scripting 12:python3-base-3.4.6-25.7.1 SUSE Linux Enterprise Server 12 SP3:libpython3_4m1_0-3.4.6-25.7.1 SUSE Linux Enterprise Server 12 SP3:python3-3.4.6-25.7.1 SUSE Linux Enterprise Server 12 SP3:python3-base-3.4.6-25.7.1 SUSE Linux Enterprise Server 12 SP3:python3-curses-3.4.6-25.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libpython3_4m1_0-3.4.6-25.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python3-3.4.6-25.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python3-base-3.4.6-25.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python3-curses-3.4.6-25.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:python3-devel-3.4.6-25.7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180934-1/ https://www.suse.com/security/cve/CVE-2017-18207.html CVE-2017-18207 https://bugzilla.suse.com/1083507 SUSE Bug 1083507