GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2021:0154-1

Vulnerability from csaf_opensuse - Published: 2021-01-24 17:22 - Updated: 2021-01-24 17:22
Summary
Security update for wavpack
Severity
Moderate
Notes
Title of the patch: Security update for wavpack
Description of the patch: This update for wavpack fixes the following issues: - Update to version 5.4.0 * CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414) * fixed: disable A32 asm code when building for Apple silicon * fixed: issues with Adobe-style floating-point WAV files * added: --normalize-floats option to wvunpack for correctly exporting un-normalized floating-point files - Update to version 5.3.0 * fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448 * fixed: trailing garbage characters on imported ID3v2 TXXX tags * fixed: various minor undefined behavior and memory access issues * fixed: sanitize tag extraction names for length and path inclusion * improved: reformat wvunpack 'help' and split into long + short versions * added: regression testing to Travis CI for OSS-Fuzz crashers - Updated to version 5.2.0 *fixed: potential security issues including the following CVEs: CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342), CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319 * added: support for CMake, Travis CI, and Google's OSS-fuzz * fixed: use correction file for encode verify (pipe input, Windows) * fixed: correct WAV header with actual length (pipe input, -i option) * fixed: thumb interworking and not needing v6 architecture (ARM asm) * added: handle more ID3v2.3 tag items and from all file types * fixed: coredump on Sparc64 (changed MD5 implementation) * fixed: handle invalid ID3v2.3 tags from sacd-ripper * fixed: several corner-case memory leaks This update was imported from the SUSE:SLE-15:Update update project.
Patchnames: openSUSE-2021-154
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2018-10536
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2018-10537
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact important
CVE-2018-10538
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact moderate
CVE-2018-10539
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact moderate
CVE-2018-10540
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact moderate
CVE-2018-19840
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact low
CVE-2018-19841
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact low
CVE-2018-6767
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact important
CVE-2018-7253
4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact moderate
CVE-2018-7254
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact low
CVE-2019-1010319
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact moderate
CVE-2019-11498
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact low
CVE-2020-35738
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 7 products, the same list as for CVE-2018-10536
Threats
Impact important
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://lists.opensuse.org/archives/list/security… self
https://lists.opensuse.org/archives/list/security… self
https://bugzilla.suse.com/1091340 self
https://bugzilla.suse.com/1091341 self
https://bugzilla.suse.com/1091342 self
https://bugzilla.suse.com/1091343 self
https://bugzilla.suse.com/1091344 self
https://bugzilla.suse.com/1180414 self
https://www.suse.com/security/cve/CVE-2018-10536/ self
https://www.suse.com/security/cve/CVE-2018-10537/ self
https://www.suse.com/security/cve/CVE-2018-10538/ self
https://www.suse.com/security/cve/CVE-2018-10539/ self
https://www.suse.com/security/cve/CVE-2018-10540/ self
https://www.suse.com/security/cve/CVE-2018-19840/ self
https://www.suse.com/security/cve/CVE-2018-19841/ self
https://www.suse.com/security/cve/CVE-2018-6767/ self
https://www.suse.com/security/cve/CVE-2018-7253/ self
https://www.suse.com/security/cve/CVE-2018-7254/ self
https://www.suse.com/security/cve/CVE-2019-1010319/ self
https://www.suse.com/security/cve/CVE-2019-11498/ self
https://www.suse.com/security/cve/CVE-2020-35738/ self
https://www.suse.com/security/cve/CVE-2018-10536 external
https://bugzilla.suse.com/1091344 external
https://www.suse.com/security/cve/CVE-2018-10537 external
https://bugzilla.suse.com/1091343 external
https://www.suse.com/security/cve/CVE-2018-10538 external
https://bugzilla.suse.com/1091342 external
https://www.suse.com/security/cve/CVE-2018-10539 external
https://bugzilla.suse.com/1091341 external
https://www.suse.com/security/cve/CVE-2018-10540 external
https://bugzilla.suse.com/1091340 external
https://www.suse.com/security/cve/CVE-2018-19840 external
https://bugzilla.suse.com/1120930 external
https://www.suse.com/security/cve/CVE-2018-19841 external
https://bugzilla.suse.com/1120929 external
https://www.suse.com/security/cve/CVE-2018-6767 external
https://bugzilla.suse.com/1079746 external
https://www.suse.com/security/cve/CVE-2018-7253 external
https://bugzilla.suse.com/1081692 external
https://www.suse.com/security/cve/CVE-2018-7254 external
https://bugzilla.suse.com/1081693 external
https://www.suse.com/security/cve/CVE-2019-1010319 external
https://bugzilla.suse.com/1141334 external
https://www.suse.com/security/cve/CVE-2019-11498 external
https://bugzilla.suse.com/1133384 external
https://www.suse.com/security/cve/CVE-2020-35738 external
https://bugzilla.suse.com/1180414 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for wavpack",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for wavpack fixes the following issues:\n\n- Update to version 5.4.0\n  * CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414) \n  * fixed: disable A32 asm code when building for Apple silicon\n  * fixed: issues with Adobe-style floating-point WAV files\n  * added: --normalize-floats option to wvunpack for correctly\n             exporting un-normalized floating-point files\n- Update to version 5.3.0 \n  * fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448\n  * fixed: trailing garbage characters on imported ID3v2 TXXX tags\n  * fixed: various minor undefined behavior and memory access issues\n  * fixed: sanitize tag extraction names for length and path inclusion\n  * improved: reformat wvunpack \u0027help\u0027 and split into long + short versions\n  * added: regression testing to Travis CI for OSS-Fuzz crashers\n- Updated to version 5.2.0 \n  *fixed: potential security issues including the following CVEs:\n         CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344),\n         CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342),  \n         CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), \n         CVE-2018-7254,  CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 \n         and CVE-2019-1010319\n  * added: support for CMake, Travis CI, and Google\u0027s OSS-fuzz\n  * fixed: use correction file for encode verify (pipe input, Windows)\n  * fixed: correct WAV header with actual length (pipe input, -i option)\n  * fixed: thumb interworking and not needing v6 architecture (ARM asm)\n  * added: handle more ID3v2.3 tag items and from all file types\n  * fixed: coredump on Sparc64 (changed MD5 implementation)\n  * fixed: handle invalid ID3v2.3 tags from sacd-ripper\n  * fixed: several corner-case memory leaks\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-154",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0154-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0154-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FD5IPNZ6LGJLORJOQVT3MAHBWF3ORQPT/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0154-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FD5IPNZ6LGJLORJOQVT3MAHBWF3ORQPT/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1091340",
        "url": "https://bugzilla.suse.com/1091340"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1091341",
        "url": "https://bugzilla.suse.com/1091341"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1091342",
        "url": "https://bugzilla.suse.com/1091342"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1091343",
        "url": "https://bugzilla.suse.com/1091343"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1091344",
        "url": "https://bugzilla.suse.com/1091344"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180414",
        "url": "https://bugzilla.suse.com/1180414"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-10536 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-10536/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-10537 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-10537/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-10538 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-10538/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-10539 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-10539/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-10540 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-10540/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19840 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19840/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19841 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19841/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-6767 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-6767/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-7253 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-7253/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-7254 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-7254/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-1010319 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-1010319/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-11498 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-11498/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35738 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35738/"
      }
    ],
    "title": "Security update for wavpack",
    "tracking": {
      "current_release_date": "2021-01-24T17:22:08Z",
      "generator": {
        "date": "2021-01-24T17:22:08Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0154-1",
      "initial_release_date": "2021-01-24T17:22:08Z",
      "revision_history": [
        {
          "date": "2021-01-24T17:22:08Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libwavpack1-5.4.0-lp151.5.6.1.i586",
                "product": {
                  "name": "libwavpack1-5.4.0-lp151.5.6.1.i586",
                  "product_id": "libwavpack1-5.4.0-lp151.5.6.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "wavpack-5.4.0-lp151.5.6.1.i586",
                "product": {
                  "name": "wavpack-5.4.0-lp151.5.6.1.i586",
                  "product_id": "wavpack-5.4.0-lp151.5.6.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "wavpack-devel-5.4.0-lp151.5.6.1.i586",
                "product": {
                  "name": "wavpack-devel-5.4.0-lp151.5.6.1.i586",
                  "product_id": "wavpack-devel-5.4.0-lp151.5.6.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libwavpack1-5.4.0-lp151.5.6.1.x86_64",
                "product": {
                  "name": "libwavpack1-5.4.0-lp151.5.6.1.x86_64",
                  "product_id": "libwavpack1-5.4.0-lp151.5.6.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
                "product": {
                  "name": "libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
                  "product_id": "libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "wavpack-5.4.0-lp151.5.6.1.x86_64",
                "product": {
                  "name": "wavpack-5.4.0-lp151.5.6.1.x86_64",
                  "product_id": "wavpack-5.4.0-lp151.5.6.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "wavpack-devel-5.4.0-lp151.5.6.1.x86_64",
                "product": {
                  "name": "wavpack-devel-5.4.0-lp151.5.6.1.x86_64",
                  "product_id": "wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.1",
                "product": {
                  "name": "openSUSE Leap 15.1",
                  "product_id": "openSUSE Leap 15.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwavpack1-5.4.0-lp151.5.6.1.i586 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586"
        },
        "product_reference": "libwavpack1-5.4.0-lp151.5.6.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwavpack1-5.4.0-lp151.5.6.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64"
        },
        "product_reference": "libwavpack1-5.4.0-lp151.5.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64"
        },
        "product_reference": "libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wavpack-5.4.0-lp151.5.6.1.i586 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586"
        },
        "product_reference": "wavpack-5.4.0-lp151.5.6.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wavpack-5.4.0-lp151.5.6.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64"
        },
        "product_reference": "wavpack-5.4.0-lp151.5.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wavpack-devel-5.4.0-lp151.5.6.1.i586 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586"
        },
        "product_reference": "wavpack-devel-5.4.0-lp151.5.6.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wavpack-devel-5.4.0-lp151.5.6.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        },
        "product_reference": "wavpack-devel-5.4.0-lp151.5.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-10536",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-10536"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-10536",
          "url": "https://www.suse.com/security/cve/CVE-2018-10536"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1091344 for CVE-2018-10536",
          "url": "https://bugzilla.suse.com/1091344"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-10536"
    },
    {
      "cve": "CVE-2018-10537",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-10537"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-10537",
          "url": "https://www.suse.com/security/cve/CVE-2018-10537"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1091343 for CVE-2018-10537",
          "url": "https://bugzilla.suse.com/1091343"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-10537"
    },
    {
      "cve": "CVE-2018-10538",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-10538"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-10538",
          "url": "https://www.suse.com/security/cve/CVE-2018-10538"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1091342 for CVE-2018-10538",
          "url": "https://bugzilla.suse.com/1091342"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-10538"
    },
    {
      "cve": "CVE-2018-10539",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-10539"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-10539",
          "url": "https://www.suse.com/security/cve/CVE-2018-10539"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1091341 for CVE-2018-10539",
          "url": "https://bugzilla.suse.com/1091341"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-10539"
    },
    {
      "cve": "CVE-2018-10540",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-10540"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-10540",
          "url": "https://www.suse.com/security/cve/CVE-2018-10540"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1091340 for CVE-2018-10540",
          "url": "https://bugzilla.suse.com/1091340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-10540"
    },
    {
      "cve": "CVE-2018-19840",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19840"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19840",
          "url": "https://www.suse.com/security/cve/CVE-2018-19840"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1120930 for CVE-2018-19840",
          "url": "https://bugzilla.suse.com/1120930"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-19840"
    },
    {
      "cve": "CVE-2018-19841",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19841"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19841",
          "url": "https://www.suse.com/security/cve/CVE-2018-19841"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1120929 for CVE-2018-19841",
          "url": "https://bugzilla.suse.com/1120929"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-19841"
    },
    {
      "cve": "CVE-2018-6767",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-6767"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-6767",
          "url": "https://www.suse.com/security/cve/CVE-2018-6767"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079746 for CVE-2018-6767",
          "url": "https://bugzilla.suse.com/1079746"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-6767"
    },
    {
      "cve": "CVE-2018-7253",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-7253"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-7253",
          "url": "https://www.suse.com/security/cve/CVE-2018-7253"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1081692 for CVE-2018-7253",
          "url": "https://bugzilla.suse.com/1081692"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-7253"
    },
    {
      "cve": "CVE-2018-7254",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-7254"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-7254",
          "url": "https://www.suse.com/security/cve/CVE-2018-7254"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1081693 for CVE-2018-7254",
          "url": "https://bugzilla.suse.com/1081693"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-7254"
    },
    {
      "cve": "CVE-2019-1010319",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-1010319"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-1010319",
          "url": "https://www.suse.com/security/cve/CVE-2019-1010319"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1141334 for CVE-2019-1010319",
          "url": "https://bugzilla.suse.com/1141334"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-1010319"
    },
    {
      "cve": "CVE-2019-11498",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-11498"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a \"Conditional jump or move depends on uninitialised value\" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-11498",
          "url": "https://www.suse.com/security/cve/CVE-2019-11498"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1133384 for CVE-2019-11498",
          "url": "https://bugzilla.suse.com/1133384"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-11498"
    },
    {
      "cve": "CVE-2020-35738",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35738"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later \"unofficial\" releases through 5.3.2, which are also affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
          "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35738",
          "url": "https://www.suse.com/security/cve/CVE-2020-35738"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180414 for CVE-2020-35738",
          "url": "https://bugzilla.suse.com/1180414"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:libwavpack1-32bit-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:libwavpack1-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-5.4.0-lp151.5.6.1.x86_64",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.i586",
            "openSUSE Leap 15.1:wavpack-devel-5.4.0-lp151.5.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-24T17:22:08Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-35738"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.