WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to parse a .wav file. The component is: ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade wavpack-develUpgrade wavpack | May 4, 2022 | Jul 11, 2019 |
| Alpine Linux | — | Upgrade wavpack | Nov 8, 2019 | Jul 11, 2019 |
| Centos_linux | — | Upgrade wavpackUpgrade wavpack-debugsourceUpgrade wavpack-debuginfo | Apr 29, 2020 | Jul 11, 2019 |
| Debian | — | Upgrade wavpack | Jan 18, 2021 | Jul 11, 2019 |
| Oracle_linux | — | Upgrade wavpack-develUpgrade wavpack | Oct 5, 2022 | Jul 12, 2019 |
| Redhat_linux | — | Upgrade wavpack-debuginfoUpgrade wavpackNo solution existsUpgrade wavpack-develUpgrade wavpack-debugsource | Apr 29, 2020 | Jul 11, 2019 |
| Rocky_linux | — | Upgrade wavpack-debugsourceUpgrade wavpackUpgrade wavpack-develUpgrade wavpack-debuginfo | Mar 12, 2024 | Jul 11, 2019 |
| Ubuntu | — | Upgrade wavpackUpgrade libwavpack1 | Jul 17, 2019 | Jul 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub