CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18207
https://notcve.org/view.php?id=CVE-2017-18207
The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions. ** EN DISPUTA ** La función Wave_read._read_fmt_chunk en Lib/wave.py en Python, hasta la versión 3.6.4, no garantiza un valor de canal nonzero, lo que permite que atacantes remotos provoquen una denegación de servicio (error de división entre cero y cierre inesperado de la aplicación) mediante un archivo de audio wav manipulado. NOTA: el vendedor informa que las aplicaciones de Python "necesitan estar preparadas para manejar una amplia variedad de excepciones". • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html https://bugs.python.org/issue32056 • CWE-369: Divide By Zero •
CVSS: 3.6EPSS: 0%CPEs: 5EXPL: 1CVE-2018-1000030
https://notcve.org/view.php?id=CVE-2018-1000030
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. • https://github.com/tylepr96/CVE-2018-1000030 https://bugs.python.org/issue31530 https://drive.google.com/file/d/1oyR9DAZjZK_SCn3mor6NRAYLJS6ueXaY/view https://security.gentoo.org/glsa/201811-02 https://usn.ubuntu.com/3817-1 https://usn.ubuntu.com/3817-2 https://www.dropbox.com/sh/sj3ee7xv55j36k7/AADwP-YfOYikBMuy32e0uvPFa?dl=0 https://www.oracle.com/security-alerts/cpujan2020.html • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17522
https://notcve.org/view.php?id=CVE-2017-17522
Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting ** EN DISPUTA ** Lib/webbrowser.py en Python hasta la versión 3.6.3 no valida las cadenas antes de iniciar el programa especificado por la variable de entorno BROWSER. Esto podría permitir que atacantes remotos lleven a cabo ataques de inyección de argumentos mediante una URL manipulada. NOTA: el mantenedor del software indica que es imposible la explotación de esta vulnerabilidad debido a que el código confía en subprocess.Popen y el ajuste por defecto shell=False. • http://www.securityfocus.com/bid/102207 https://bugs.python.org/issue32367 https://security-tracker.debian.org/tracker/CVE-2017-17522 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 0CVE-2017-1000158
https://notcve.org/view.php?id=CVE-2017-1000158
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution) CPython (también conocido como Python) hasta la versión 2.7.13 es vulnerable a un desbordamiento de enteros en la función PyString_DecodeEscape en stringobject.c, lo que resulta en un desbordamiento de búfer basado en memoria dinámica (heap) y, posiblemente, la ejecución de código arbitrario. • http://www.securitytracker.com/id/1039890 https://bugs.python.org/issue30657 https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html https://security.gentoo.org/glsa/201805-02 https://security.netapp.com/advisory/ntap-20230216-0001 https://www.debian.org/security/2018/ • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 1CVE-2017-9233
https://notcve.org/view.php?id=CVE-2017-9233
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD. Una vulnerabilidad de XML External Entity (XEE) en libexpat versión 2.2.0 y anteriores (Expat XML Parser Library) permite que los atacantes consigan que el analizador entre en un bucle infinito utilizando una definición de entidad externa mal formada desde una DTD externa. • http://www.debian.org/security/2017/dsa-3898 http://www.openwall.com/lists/oss-security/2017/06/17/7 http://www.securityfocus.com/bid/99276 http://www.securitytracker.com/id/1039427 https://github.com/libexpat/libexpat/blob/master/expat/Changes https://libexpat.github.io/doc/cve-2017-9233 https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40% • CWE-611: Improper Restriction of XML External Entity Reference CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •