USN-3839-1: WavPack vulnerabilities

It was discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this issue to cause a denial of service. CVE-2018-19840, CVE-2018-19841...

CVE-2018-19841

CVE-2018-19841 affects WavPack up to version 5.1.0: the WavpackVerifySingleBlock function in open_utils.c can trigger an out-of-bounds read and cause a denial-of-service (application crash). Multiple connected advisories confirm this vulnerability and reference affected WAVPACK builds; other CVEs...

CVE-2018-19841

The function WavpackVerifySingleBlock in openutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service out-of-bounds read and application crash via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack...