Vulnerabilities > Python > Python > 3.3.2

DATE CVE VULNERABILITY TITLE RISK
2018-03-01 CVE-2017-18207 Divide By Zero vulnerability in Python
The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file.
network
low complexity
python CWE-369
6.5
2017-12-14 CVE-2017-17522 Injection vulnerability in Python
Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
network
low complexity
python CWE-74
8.8
2017-08-24 CVE-2014-4616 Improper Validation of Array Index vulnerability in multiple products
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.
4.3
2017-07-25 CVE-2017-9233 Infinite Loop vulnerability in multiple products
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
network
low complexity
libexpat-project python debian CWE-835
7.5
2016-09-02 CVE-2016-5699 HTTP Response Splitting vulnerability in Python
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
network
low complexity
python CWE-113
6.1
2016-09-02 CVE-2016-5636 Integer Overflow or Wraparound vulnerability in Python
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
network
low complexity
python CWE-190
critical
10.0
2016-09-02 CVE-2016-0772 Protection Mechanism Failure vulnerability in Python
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
network
python CWE-693
5.8
2016-06-30 CVE-2016-4472 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.
network
high complexity
libexpat-project canonical mcafee python CWE-119
8.1
2016-06-07 CVE-2013-7440 Data Processing Errors vulnerability in Python
The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
network
python CWE-19
4.3
2016-05-26 CVE-2016-0718 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
9.8