PRIOn knowledge basePRION:CVE-2019-11498Design/Logic Flaw
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
6.1 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.009 Low
EPSS
Percentile
82.6%
WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a “Conditional jump or move depends on uninitialised value” condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.
| CPE | Name | Operator | Version |
|---|---|---|---|
| ubuntu_linux | eq | 18.04 | |
| ubuntu_linux | eq | 18.10 | |
| ubuntu_linux | eq | 19.04 | |
| debian_linux | eq | 9.0 | |
| fedora | eq | 29 | |
| fedora | eq | 30 | |
| fedora | eq | 31 | |
| wavpack | le | 5.1.0 |
References
github.com/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4
github.com/dbry/WavPack/issues/67
lists.debian.org/debian-lts-announce/2021/01/msg00013.html
lists.fedoraproject.org/archives/list/[email protected]/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA/
lists.fedoraproject.org/archives/list/[email protected]/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/
lists.fedoraproject.org/archives/list/[email protected]/message/NZDKXGA2ZNSSM64ZYDHOWCO4Q4VAKAON/
lists.fedoraproject.org/archives/list/[email protected]/message/SCK2YJXY6V5CKGKSF2PPN7RL2DXVOC6G/
security.gentoo.org/glsa/202007-19
usn.ubuntu.com/3960-1/
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
6.1 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.009 Low
EPSS
Percentile
82.6%