A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0
    allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via
    a maliciously crafted RF64 file. (CVE-2018-6767)

  - The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to
    cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously
    crafted DSDIFF file. (CVE-2018-7253)

  - The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to
    cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect
    memory allocation, via a maliciously crafted CAF file. (CVE-2018-7254)

  - The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to
    cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file
    because WavpackSetConfiguration64 mishandles a sample rate of zero. (CVE-2018-19840)

  - The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows
    attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack
    Lossless Audio file, as demonstrated by wvunpack. (CVE-2018-19841)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0
    allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via
    a maliciously crafted RF64 file. (CVE-2018-6767)

  - The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to
    cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously
    crafted DSDIFF file. (CVE-2018-7253)

  - The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to
    cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect
    memory allocation, via a maliciously crafted CAF file. (CVE-2018-7254)

This update for wavpack fixes the following issues :

  - Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414) 

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

  - Update to version 5.3.0 

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

  - Updated to version 5.2.0 

    *fixed: potential security issues including the     following CVEs: CVE-2018-19840, CVE-2018-19841,     CVE-2018-10536 (bsc#1091344), CVE-2018-10537     (bsc#1091343) CVE-2018-10538 (bsc#1091342),     CVE-2018-10539 (bsc#1091341), CVE-2018-10540     (bsc#1091340), CVE-2018-7254, CVE-2018-7253,     CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

This update was imported from the SUSE:SLE-15:Update update project.

This update for wavpack fixes the following issues :

Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414)

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

Update to version 5.3.0

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

Updated to version 5.2.0

*fixed: potential security issues including the following CVEs:
CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342), CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New wavpack packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

Sebastian Ramacher reports :

A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.

The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.

The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.

Thuan Pham reports :

An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.

An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.

An issue was discovered in WavPack 5.1.0 and earlier for WAV input.
Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.

An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input.
Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.

An issue was discovered in WavPack 5.1.0 and earlier for W64 input.
Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.

- CVE-2018-6767

  - CVE-2018-7253

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-6767, CVE-2018-7253, and CVE-2018-7254

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Joonun Jang discovered several problems in wavpack, an audio compression format suite. Incorrect processing of input resulted in several heap- and stack-based buffer overflows, leading to application crash or potential code execution.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3568-1 advisory.

    Hanno Bck discovered that WavPack incorrectly handled certain WV files. An attacker could possibly use     this to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2016-10169)

    Joonun Jang discovered that WavPack incorrectly handled certain RF64 files. An attacker could possibly use     this to cause a denial of service. This issue only affected Ubuntu 17.10. (CVE-2018-6767)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
427478	Alpine: multiple wavpack packages: security update to 5.1.0-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427478	Alpine: multiple wavpack packages: security update to 5.1.0-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
407546	Alpine: multiple wavpack packages: security update to 5.1.0-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407546	Alpine: multiple wavpack packages: security update to 5.1.0-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400714	Alpine: multiple wavpack packages: security update to 5.1.0-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400714	Alpine: multiple wavpack packages: security update to 5.1.0-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
145376	openSUSE Security Update : wavpack (openSUSE-2021-154)	Nessus	SuSE Local Security Checks	high
145305	openSUSE Security Update : wavpack (openSUSE-2021-153)	Nessus	SuSE Local Security Checks	high
145253	SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2021:0186-1)	Nessus	SuSE Local Security Checks	high
132333	Slackware 14.0 / 14.1 / 14.2 / current : wavpack (SSA:2019-353-01)	Nessus	Slackware Local Security Checks	high
109749	FreeBSD : wavpack -- multiple vulnerabilities (50210bc1-54ef-11e8-95d9-9c5c8e75236a)	Nessus	FreeBSD Local Security Checks	high
108313	Fedora 26 : wavpack (2018-d94e205df8)	Nessus	Fedora Local Security Checks	high
107166	Fedora 26 : mingw-wavpack (2018-5950093e69)	Nessus	Fedora Local Security Checks	high
107153	Fedora 27 : mingw-wavpack (2018-023baab00f)	Nessus	Fedora Local Security Checks	high
107028	Fedora 27 : wavpack (2018-3ba1be2e79)	Nessus	Fedora Local Security Checks	high
107025	Debian DSA-4125-1 : wavpack - security update	Nessus	Debian Local Security Checks	high
106794	Ubuntu 14.04 LTS / 16.04 LTS : WavPack vulnerabilities (USN-3568-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-6767

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high