SUSE-SU-2020:2727-1 Security update for wavpack

This update for wavpack fixes the following issues: Security issues fixed: - CVE-2018-19840: Fixed a denial-of-service in the WavpackPackInit function from packutils.c bsc1120930...

WavPack: Multiple vulnerabilities

Background WavPack is a set of hybrid lossless audio compression tools. Description Multiple vulnerabilities have been discovered in WavPack. Please review the CVE identifiers referenced below for details. Impact A remote attacker could send a specially crafted audio file possibly resulting in a...

GLSA-202007-19 : WavPack: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202007-19 WavPack: Multiple vulnerabilities Multiple vulnerabilities have been discovered in WavPack. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could send a specially crafted audio...

OSV-2020-1006 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19928 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples WavpackSeekSample64...

OSV-2020-48 UNKNOWN READ in decode_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20448 Crash type: UNKNOWN READ Crash state: decodefast unpackdsdsamples WavpackUnpackSamples...

ffmpeg:ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer: Heap-buffer-overflow in wavpack_decode_block

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5678686190960640 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDWAVPACKfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

Arbitrary Code Execution

wavpack is vulnerable to arbitrary code execution. A buffer overflow in the ParseCaffHeaderConfig function in cli/caff.c allows a remote attacker to execute arbitrary code via a malicious CAF file...

Arbitrary Code Execution

wavpack is vulnerable to arbitrary code execution. A heap-based buffer over-read in the ParseDsdiffHeaderConfig function in cli/dsdiff.c allows a remote attacker to execute arbitrary code on the system or cause a denial-of-service via a malicious DSDIFF file...

Arbitrary Code Execution

wavpack is vulnerable to arbitrary code execution. The vulnerability exists as the W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks...

Arbitrary Code Execution

wavpack is vulnerable to arbitrary code execution. The vulnerability exists as the WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks...

Denial Of Service (DoS)

wavpack is vulnerable to denial of service DoS. The vulnerability exists as an out-of-bounds write can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a...

Denial Of Service (DoS)

wavpack is vulnerable to denial of service DoS. The vulnerability exists as an issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory...

wavpack security update

5.1.0-15 - fix Out-of-bounds read in WavpackVerifySingleBlock function 1663151 - CVE-2018-19841 5.1.0-14 - fix uninitialized variable in ParseCaffHeaderConfig 1741251 - CVE-2019-1010317 5.1.0-13 - fortify parsing of .dff files 1707428, 1733627 - CVE-2019-1010315 - CVE-2019-11498 5.1.0-12 - fix...

Denial Of Service (DoS)

wavpack is vulnerable to denial of service DoS. The vulnerability exists as a divide by zero in ParseDsdiffHeaderConfig leads to crash...

Denial Of Service (DoS)

wavpack is vulnerable to denial of service DoS. The vulnerability exists through the use of uninitialized variable in ParseCaffHeaderConfig leads to DoS...

Denial Of Service (DoS)

wavpack is vulnerable to denial of service DoS. The vulnerability exists through the use of uninitialized variable in ParseWave64HeaderConfig leads to DoS...

Denial Of Service (DoS)

wavpack is vulnerable to denial of service DoS. The vulnerability exists through the use of uninitialized variable in WavpackSetConfiguration64 leads to DoS...

Denial Of Service (DoS)

wawpack is vulnerable to denial of service DoS. The vulnerability exists through an out-of-bounds read in the WavpackVerifySingleBlock function...

wawpack: Infinite loop in WavpackPackInit function lead to DoS

The function WavpackPackInit in packutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service resource exhaustion caused by an infinite loop via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero...

Low: Red Hat Security Advisory: wavpack security update

An update for wavpack is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...