An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.

This update for wavpack fixes the following issues :

  - Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414) 

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

  - Update to version 5.3.0 

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

  - Updated to version 5.2.0 

    *fixed: potential security issues including the     following CVEs: CVE-2018-19840, CVE-2018-19841,     CVE-2018-10536 (bsc#1091344), CVE-2018-10537     (bsc#1091343) CVE-2018-10538 (bsc#1091342),     CVE-2018-10539 (bsc#1091341), CVE-2018-10540     (bsc#1091340), CVE-2018-7254, CVE-2018-7253,     CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

This update was imported from the SUSE:SLE-15:Update update project.

This update for wavpack fixes the following issues :

Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414)

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

Update to version 5.3.0

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

Updated to version 5.2.0

*fixed: potential security issues including the following CVEs:
CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342), CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes for: CVE-2018-10536 CVE-2018-10537 CVE-2018-10538 CVE-2018-10539 CVE-2018-10540 CVE-2018-19840 CVE-2018-19841 CVE-2019-11498 CVE-2019-1010315 CVE-2019-1010319 CVE-2019-1010317

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New wavpack packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

Security fix for CVE-2018-10536 CVE-2018-10537 CVE-2018-10538 CVE-2018-10539 CVE-2018-10540

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Ramacher reports :

A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.

The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.

The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.

Thuan Pham reports :

An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.

An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.

An issue was discovered in WavPack 5.1.0 and earlier for WAV input.
Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.

An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input.
Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.

An issue was discovered in WavPack 5.1.0 and earlier for W64 input.
Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.

Multiple vulnerabilities were discovered in the wavpack audio codec which could result in denial of service or the execution of arbitrary code if malformed media files are processed.

The oldstable distribution (jessie) is not affected.

Thuan Pham, Marcel Bohme, Andrew Santosa and Alexandru Razvan Caciulescu discovered that WavPack incorrectly handled certain .wav files. An attacker could possibly use this to execute arbitrary code or cause a denial of service. (CVE-2018-10536, CVE-2018-10537)

Thuan Pham, Marcel Bohme, Andrew Santosa and Alexandru Razvan Caciulescu discovered that WavPack incorrectly handled certain .wav files. An attacker could possibly use this to cause a denial of service. (CVE-2018-10538, CVE-2018-10539, CVE-2018-10540).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
145376	openSUSE Security Update : wavpack (openSUSE-2021-154)	Nessus	SuSE Local Security Checks	high
145305	openSUSE Security Update : wavpack (openSUSE-2021-153)	Nessus	SuSE Local Security Checks	high
145253	SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2021:0186-1)	Nessus	SuSE Local Security Checks	high
132878	Fedora 31 : mingw-wavpack (2020-e55567b6be)	Nessus	Fedora Local Security Checks	high
132877	Fedora 30 : mingw-wavpack (2020-73274c9df4)	Nessus	Fedora Local Security Checks	high
132333	Slackware 14.0 / 14.1 / 14.2 / current : wavpack (SSA:2019-353-01)	Nessus	Slackware Local Security Checks	high
120255	Fedora 28 : wavpack (2018-17a97bb25b)	Nessus	Fedora Local Security Checks	high
110173	Fedora 27 : wavpack (2018-d6002f761d)	Nessus	Fedora Local Security Checks	high
109749	FreeBSD : wavpack -- multiple vulnerabilities (50210bc1-54ef-11e8-95d9-9c5c8e75236a)	Nessus	FreeBSD Local Security Checks	high
109659	Debian DSA-4197-1 : wavpack - security update	Nessus	Debian Local Security Checks	high
109469	Ubuntu 18.04 LTS : WavPack vulnerabilities (USN-3637-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-10536

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high