WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.
References
| Link | Resource |
|---|---|
| https://github.com/dbry/WavPack/issues/66 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b | Patch Third Party Advisory |
| https://usn.ubuntu.com/4062-1/ | Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYESOAZ6Z6IG4BQBURL6OUY6P4YB6SKS/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IX3J2JML5A7KC2BLGBEFTIIZR3EM7LVJ/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/ | Mailing List Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Information
Published : 2019-07-11 20:15
Updated : 2021-01-15 13:15
NVD link : CVE-2019-1010317
Mitre link : CVE-2019-1010317
JSON object : View
Products Affected
fedoraproject
- fedora
canonical
- ubuntu_linux
wavpack
- wavpack
CWE
CWE-908
Use of Uninitialized Resource