Updated wavpack packages fix security vulnerabilities

Updated wavpack packages fixes security vulnerabilities: It was discovered that WavPack incorrectly handled certain DFF files. An attacker could possibly use this issue to cause a denial of service CVE-2019-11498. Rohan Padhye discovered that WavPack incorrectly handled certain WAV files. An...

ALPINE-CVE-2019-1010315

WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to parse a .wav file. The component is: ParseDsdiffHeaderConfig dsdiff.c:282. The attack vector is: Maliciously crafted .wav file. The fixed...

Fedora 28 : SDL (2019-918aad6bd5)

This release fixes a buffer overflow when processing RIFF/WAV files with in invalid MS ADPCM predictor. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as mu...

Fedora 29 : SDL (2019-bf531902c8)

This release fixes a buffer overflow when processing RIFF/WAV files with in invalid MS ADPCM predictor. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as mu...

MGASA-2019-0045 Updated wavpack packages fix security vulnerabilities

Joonun Jang discovered that WavPack incorrectly handled certain RF64 files. An attacker could possibly use this to cause a denial of service CVE-2018-6767. It was discovered that WavPack incorrectly handled certain DSDIFF files. An attacker could possibly use this to execute arbitrary code or cau...

USN-3839-1: WavPack vulnerabilities

It was discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this issue to cause a denial of service. CVE-2018-19840, CVE-2018-19841...

CVE-2018-16797

A heap-based buffer overflow in PotPlayerMini.exe in PotPlayer 1.7.8556 allows remote attackers to execute arbitrary code via a .wav file with large BytesPerSec and SamplesPerSec values, and a small DataChunkSize value...

SUSE-SU-2018:1786-1 Security update for python

This update for python fixes the following issues: The following security vulnerabilities were addressed: - Add a check to Lib/wave.py that verifies that at least one channel is provided. Prior to this, attackers could cause a denial of service via a crafted wav format audio file. bsc1083507,...

USN-3637-1 wavpack vulnerabilities

Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu discovered that WavPack incorrectly handled certain .wav files. An attacker could possibly use this to execute arbitrary code or cause a denial of service. CVE-2018-10536, CVE-2018-10537 Thuan Pham, Marcel Böhme, Andrew...

Updated aubio packages fix security vulnerability

Specially crafted wav files could have been used to cause an application crash CVE-2017-17054...

Python 'Wave_read._read_fmt_chunk' function denial of service vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A security vulnerability exists in the 'waveread.readfmtchunk' function in the Lib/wave.py file in Python...

SWFTools Software Handles wav Format with Denial of Service Vulnerability

SWFTools is a collection of utilities to work with Adobe Flash files SWF files. A denial of service vulnerability exists in the SWFTools software when handling the wav file format. An attacker can exploit the vulnerability to cause the program to crash by constructing malformed wav format files...

SoundTouch 1.9.2 - Multiple Vulnerabilities

SoundTouch 1.9.2 - Multiple Vulnerabilities SoundTouch multiple vulnerabilities ================ Author : qflb.wu =============== Introduction: ============= SoundTouch is an open-source audio processing library for changing the Tempo, Pitch and Playback Rates of audio streams or audio files. The...

thesoundarchive.com XSS vulnerability

Vulnerable URL: http://www.thesoundarchive.com/play-wav-files.asp?sound=1"...

speex speexenc parsing channel field denial of service vulnerability

Speex is an open source, free, patent-free audio compression format primarily for speech. The encoder program speexenc in speex-1.2rc2 and previous versions crashes when parsing wav files with zero values in the channel field resulting in a division by zero...

The vulnerability of the Firefox browser allows a malicious individual to execute arbitrary code, gain access to confidential information, or cause a service failure.

The Mozilla Firefox browser contains a vulnerability related to errors in the implementation of the mozilla::WaveReader::DecodeAudioData function. Exploiting this vulnerability allows malicious actors to gain access to confidential information from the dynamic memory of the process, trigger servi...

[SECURITY] Fedora 23 Update: libsndfile-1.0.25-18.fc23

libsndfile is a C library for reading and writing sound files such as AIFF, AU, WAV, and others through one standard interface. It can currently read/write 8, 16, 24 and 32-bit PCM files as well as 32 and 64-bit floating point WAV files and a number of compressed formats. It compiles and runs on...

SUSE SLED11 Security Update : vorbis-tools (SUSE-SU-2015:1775-1)

vorbis-tools was updated to fix several security issues. - A buffer overflow in aiffopen that could be triggered by opening prepared malicious files CVE-2015-6749, bsc943795. - A division by zero and integer overflow by crafted WAV files was fixed CVE-2014-9638, CVE-2014-9639, bnc914439, bnc91444...

sox -- memory corruption vulnerabilities

Michele Spagnuolo, Google Security Team, reports: The write heap buffer overflows are related to ADPCM handling in WAV files, while the read heap buffer overflow is while opening a .VOC...

SUSE SLED12 / SLES12 Security Update : vorbis-tools (SUSE-SU-2015:1014-1)

Vorbis tools was updated to fix division by zero and integer overflows by crafted WAV files CVE-2014-9638, CVE-2014-9639, bnc914439, bnc914441, that would allow attackers to crash the vorbis tools processes. Note that Tenable Network Security has extracted the preceding description block directly...