CVE-2017-18207: Divide by Zero
DISPUTED The Waveread.readfmtchunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-18207?
CVE-2017-18207 is considered a denial of service vulnerability due to potential divide-by-zero errors.
How do I fix CVE-2017-18207?
Updating to a version of Python later than 3.6.4 that addresses this vulnerability is recommended.
What type of attack does CVE-2017-18207 facilitate?
CVE-2017-18207 allows attackers to execute a denial of service attack by exploiting crafted wav format audio files.
Which versions of Python are affected by CVE-2017-18207?
Python versions from 3.6 and below, up to and including 3.6.4 are affected by CVE-2017-18207.
Is CVE-2017-18207 still an active threat?
The threat level of CVE-2017-18207 depends on the environment, but it poses risks primarily for systems running the affected versions of Python.