The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-wavpackalma-upgrade-wavpack-devel | May 4, 2022 | Dec 4, 2018 | |
| Alpine Linux | alpine-linux-upgrade-wavpack | Feb 15, 2019 | Dec 4, 2018 | |
| Centos_linux | — | centos-upgrade-wavpackcentos-upgrade-wavpack-debuginfocentos-upgrade-wavpack-debugsource | Apr 29, 2020 | Dec 4, 2018 |
| Debian | debian-upgrade-wavpack | Jan 18, 2021 | Dec 4, 2018 | |
| Gentoo Linux | gentoo-linux-upgrade-media-sound-wavpack | Jul 28, 2020 | Dec 4, 2018 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-wavpack | Aug 28, 2019 | Dec 4, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-wavpackoracle-linux-upgrade-wavpack-devel | Oct 5, 2022 | Nov 29, 2018 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-wavpackredhat-upgrade-wavpack-debuginforedhat-upgrade-wavpack-debugsourceredhat-upgrade-wavpack-devel | Apr 29, 2020 | Dec 4, 2018 | |
| Rocky_linux | rocky-upgrade-wavpackrocky-upgrade-wavpack-debuginforocky-upgrade-wavpack-debugsourcerocky-upgrade-wavpack-devel | Mar 12, 2024 | Dec 4, 2018 | |
| Suse | — | suse-upgrade-libwavpack1suse-upgrade-libwavpack1-32bitsuse-upgrade-wavpacksuse-upgrade-wavpack-devel | Apr 5, 2019 | Dec 4, 2018 |
| Ubuntu | ubuntu-upgrade-libwavpack1ubuntu-upgrade-wavpack | Dec 13, 2018 | Dec 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub