CVE-2017-18207
Python 3.5 and 2 others: The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero…
CVE-2017-18207 is fixed in Python 3.6 on 1 platform by Python 3.6 3.6.5 (version 3.6.5), released March 28, 2018. 2 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
6.5
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0132
71st percentile
The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Python 3.6 | 3.6.5 | Python 3.6 3.6.5 | Mar 28, 2018 |
| No fix yet | |||
| Python 2 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.5 (Windows apps) | No fix yet | no-fix | n/a |