CVE-2018-19841 (NVD)

2018-12-04

The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.

Products Ubuntu_linux, Debian_linux, Fedora, Leap, Wavpack
Type Out-of-bounds Read (CWE-125)
First patch https://github.com/dbry/WavPack/commit/bba5389dc598a92bdf2b297c3ea34620b6679b5b
Relevant file/s ./src/open_utils.c (modified, +2, -2)
Links • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BLSOEVEKF4VNNVNZ2AN46BJUT4TGVWT/
• http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVVKOBJR5APOB3KWUWJ4UWQHUBZQL6C6/
• https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html
• https://github.com/dbry/WavPack/issues/54

WavPack - Tree: bba5389dc5

(? files)

Filter Settings
Files
Navigation
Patch data:

(on by default)

Patched area: