https://github.com/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4

https://github.com/dbry/WavPack/issues/67

[debian-lts-announce] 20210115 [SECURITY] [DLA 2525-1] wavpack security update

FEDORA-2020-e55567b6be

FEDORA-2020-73274c9df4

FEDORA-2019-52145aa7ca

FEDORA-2019-b8a704ff4b

GLSA-202007-19

USN-3960-1

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1581 advisory.

  - wawpack: Infinite loop in WavpackPackInit function lead to DoS (CVE-2018-19840)

  - wawpack: Out-of-bounds read in WavpackVerifySingleBlock function leads to DoS (CVE-2018-19841)

  - wavpack: Divide by zero in ParseDsdiffHeaderConfig leads to crash (CVE-2019-1010315)

  - wavpack: Use of uninitialized variable in ParseCaffHeaderConfig leads to DoS (CVE-2019-1010317)

  - wavpack: Use of uninitialized variable in ParseWave64HeaderConfig leads to DoS (CVE-2019-1010319)

  - wavpack: Use of uninitialized variable in WavpackSetConfiguration64 leads to DoS (CVE-2019-11498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for wavpack fixes the following issues :

  - Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414) 

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

  - Update to version 5.3.0 

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

  - Updated to version 5.2.0 

    *fixed: potential security issues including the     following CVEs: CVE-2018-19840, CVE-2018-19841,     CVE-2018-10536 (bsc#1091344), CVE-2018-10537     (bsc#1091343) CVE-2018-10538 (bsc#1091342),     CVE-2018-10539 (bsc#1091341), CVE-2018-10540     (bsc#1091340), CVE-2018-7254, CVE-2018-7253,     CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

This update was imported from the SUSE:SLE-15:Update update project.

This update for wavpack fixes the following issues :

Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414)

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

Update to version 5.3.0

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

Updated to version 5.2.0

*fixed: potential security issues including the following CVEs:
CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342), CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilites in wavpack were found, like OOB read (which could potentially lead to a DOS attack), unexpected control flow, crashes, integer overflow, and segfaults.

For Debian 9 stretch, these problems have been fixed in version 5.0.0-2+deb9u3.

We recommend that you upgrade your wavpack packages.

For the detailed security status of wavpack please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/wavpack

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1581 advisory.

  - wawpack: Infinite loop in WavpackPackInit function lead to DoS (CVE-2018-19840)

  - wawpack: Out-of-bounds read in WavpackVerifySingleBlock function leads to DoS (CVE-2018-19841)

  - wavpack: Divide by zero in ParseDsdiffHeaderConfig leads to crash (CVE-2019-1010315)

  - wavpack: Use of uninitialized variable in ParseCaffHeaderConfig leads to DoS (CVE-2019-1010317)

  - wavpack: Use of uninitialized variable in ParseWave64HeaderConfig leads to DoS (CVE-2019-1010319)

  - wavpack: Use of uninitialized variable in WavpackSetConfiguration64 leads to DoS (CVE-2019-11498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202007-19 (WavPack: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WavPack. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted audio file possibly       resulting in a Denial of Service condition. Please review the referenced       CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Security fixes for: CVE-2018-10536 CVE-2018-10537 CVE-2018-10538 CVE-2018-10539 CVE-2018-10540 CVE-2018-19840 CVE-2018-19841 CVE-2019-11498 CVE-2019-1010315 CVE-2019-1010319 CVE-2019-1010317

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - WavpackSetConfiguration64 in pack_utils.c in     libwavpack.a in WavPack through 5.1.0 has a     'Conditional jump or move depends on uninitialised     value' condition, which might allow attackers to cause     a denial of service (application crash) via a DFF file     that lacks valid sample-rate data.(CVE-2019-11498)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wavpack fixes the following issues :

Security issues fixed :

  - CVE-2019-1010319: Fixed use of uninitialized variable in     ParseWave64HeaderConfig that can result in unexpected     control flow, crashes, and segfaults (bsc#1141334).

  - CVE-2019-11498: Fixed possible denial of service     (application crash) in WavpackSetConfiguration64 via a     DFF file that lacks valid sample-rate data     (bsc#1133384).

This update was imported from the SUSE:SLE-15:Update update project.

This update for wavpack fixes the following issues :

Security issues fixed :

CVE-2019-1010319: Fixed use of uninitialized variable in ParseWave64HeaderConfig that can result in unexpected control flow, crashes, and segfaults (bsc#1141334).

CVE-2019-11498: Fixed possible denial of service (application crash) in WavpackSetConfiguration64 via a DFF file that lacks valid sample-rate data (bsc#1133384).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix for CVE-2019-11498

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
145884	CentOS 8 : wavpack (CESA-2020:1581)	Nessus	CentOS Local Security Checks	medium
145376	openSUSE Security Update : wavpack (openSUSE-2021-154)	Nessus	SuSE Local Security Checks	medium
145305	openSUSE Security Update : wavpack (openSUSE-2021-153)	Nessus	SuSE Local Security Checks	medium
145253	SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2021:0186-1)	Nessus	SuSE Local Security Checks	medium
145167	Debian DLA-2525-1 : wavpack security update	Nessus	Debian Local Security Checks	medium
143040	RHEL 8 : wavpack (RHSA-2020:1581)	Nessus	Red Hat Local Security Checks	medium
138942	GLSA-202007-19 : WavPack: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
132878	Fedora 31 : mingw-wavpack (2020-e55567b6be)	Nessus	Fedora Local Security Checks	medium
132877	Fedora 30 : mingw-wavpack (2020-73274c9df4)	Nessus	Fedora Local Security Checks	medium
130831	EulerOS 2.0 SP8 : wavpack (EulerOS-SA-2019-2122)	Nessus	Huawei Local Security Checks	medium
128537	openSUSE Security Update : wavpack (openSUSE-2019-2067)	Nessus	SuSE Local Security Checks	medium
128073	SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2019:2191-1)	Nessus	SuSE Local Security Checks	medium
125686	Fedora 29 : wavpack (2019-b8a704ff4b)	Nessus	Fedora Local Security Checks	medium
125319	Fedora 30 : wavpack (2019-52145aa7ca)	Nessus	Fedora Local Security Checks	medium

CVE-2019-11498

MEDIUM

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium