WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade wavpackUpgrade wavpack-devel | May 4, 2022 | Apr 24, 2019 |
| Alpine Linux | — | Upgrade wavpack | Nov 8, 2019 | Apr 24, 2019 |
| Centos_linux | — | Upgrade wavpack-debugsourceUpgrade wavpackUpgrade wavpack-debuginfo | Apr 29, 2020 | Apr 24, 2019 |
| Debian | — | Upgrade wavpack | Jan 18, 2021 | Apr 24, 2019 |
| Gentoo Linux | — | Upgrade media-sound/wavpack. | Jul 28, 2020 | Apr 24, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade wavpack | Nov 19, 2019 | Apr 24, 2019 |
| Oracle_linux | — | Upgrade wavpack-develUpgrade wavpack | Oct 5, 2022 | Mar 5, 2019 |
| Redhat_linux | — | Upgrade wavpack-debugsourceUpgrade wavpack-develUpgrade wavpack-debuginfoNo solution existsUpgrade wavpack | Apr 29, 2020 | Apr 24, 2019 |
| Rocky_linux | — | Upgrade wavpackUpgrade wavpack-debugsourceUpgrade wavpack-develUpgrade wavpack-debuginfo | Mar 12, 2024 | Apr 24, 2019 |
| Suse | — | Upgrade libwavpack1Upgrade wavpack-develUpgrade libwavpack1-32bitUpgrade wavpack | Sep 6, 2019 | Apr 24, 2019 |
| Ubuntu | — | Upgrade libwavpack1Upgrade wavpack | May 4, 2019 | Apr 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub