Alpine: multiple wavpack packages: security update to 5.1.0-r2

high Tenable Cloud Security Plugin ID 407547

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability
that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format
chunks. (CVE-2018-10536)

- An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability
that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format
chunks. (CVE-2018-10537)

- An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because
ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory
allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and
subsequent malloc call, leading to insufficient memory allocation. (CVE-2018-10538)

- An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur
because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before
attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy
calculation and subsequent malloc call, leading to insufficient memory allocation. (CVE-2018-10539)

Plugin Details

Severity: High

ID: 407547

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 11/11/2025

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2018-10537

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 4/29/2018

Reference Information

CVE: CVE-2018-10536, CVE-2018-10537, CVE-2018-10538, CVE-2018-10539

Detections

Analytics