WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade wavpack-develUpgrade wavpack | May 4, 2022 | Apr 24, 2019 |
| Alpine Linux | — | Upgrade wavpack | Nov 8, 2019 | Apr 24, 2019 |
| Centos_linux | — | Upgrade wavpack-debuginfoUpgrade wavpackUpgrade wavpack-debugsource | Apr 29, 2020 | Apr 24, 2019 |
| Debian | — | Upgrade wavpack | Jan 18, 2021 | Apr 24, 2019 |
| Gentoo Linux | — | Upgrade media-sound/wavpack. | Jul 28, 2020 | Apr 24, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade wavpack | Nov 19, 2019 | Apr 24, 2019 |
| Oracle_linux | — | Upgrade wavpack-develUpgrade wavpack | Oct 5, 2022 | Mar 5, 2019 |
| Redhat_linux | — | Upgrade wavpack-develUpgrade wavpack-debuginfoUpgrade wavpackUpgrade wavpack-debugsourceNo solution exists | Apr 29, 2020 | Apr 24, 2019 |
| Rocky_linux | — | Upgrade wavpack-debugsourceUpgrade wavpackUpgrade wavpack-debuginfoUpgrade wavpack-devel | Mar 12, 2024 | Apr 24, 2019 |
| Suse | — | Upgrade libwavpack1-32bitUpgrade wavpackUpgrade libwavpack1Upgrade wavpack-devel | Sep 6, 2019 | Apr 24, 2019 |
| Ubuntu | — | Upgrade libwavpack1Upgrade wavpack | May 4, 2019 | Apr 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub