OPENSUSE-SU-2021:0154-1
Vulnerability from csaf_opensuse - Published: 2021-01-24 17:22 - Updated: 2026-09-20 19:20Summary
Security update for wavpack
Severity
Moderate
Notes
Title of the patch: Security update for wavpack
Description of the patch: This update for wavpack fixes the following issues:
- Update to version 5.4.0
* CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414)
* fixed: disable A32 asm code when building for Apple silicon
* fixed: issues with Adobe-style floating-point WAV files
* added: --normalize-floats option to wvunpack for correctly
exporting un-normalized floating-point files
- Update to version 5.3.0
* fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448
* fixed: trailing garbage characters on imported ID3v2 TXXX tags
* fixed: various minor undefined behavior and memory access issues
* fixed: sanitize tag extraction names for length and path inclusion
* improved: reformat wvunpack 'help' and split into long + short versions
* added: regression testing to Travis CI for OSS-Fuzz crashers
- Updated to version 5.2.0
*fixed: potential security issues including the following CVEs:
CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344),
CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342),
CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340),
CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498
and CVE-2019-1010319
* added: support for CMake, Travis CI, and Google's OSS-fuzz
* fixed: use correction file for encode verify (pipe input, Windows)
* fixed: correct WAV header with actual length (pipe input, -i option)
* fixed: thumb interworking and not needing v6 architecture (ARM asm)
* added: handle more ID3v2.3 tag items and from all file types
* fixed: coredump on Sparc64 (changed MD5 implementation)
* fixed: handle invalid ID3v2.3 tags from sacd-ripper
* fixed: several corner-case memory leaks
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames: openSUSE-2021-154
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.8 (High)
Affected products
Recommended
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
important
5.5 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
moderate
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
low
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
low
7.8 (High)
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
important
4 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
moderate
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
low
5.5 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
moderate
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
low
8.1 (High)
Affected products
Recommended
7 products, the same list as for
CVE-2018-10536
Threats
Impact
important
References
49 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for wavpack",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for wavpack fixes the following issues:\n\n- Update to version 5.4.0\n * CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414) \n * fixed: disable A32 asm code when building for Apple silicon\n * fixed: issues with Adobe-style floating-point WAV files\n * added: --normalize-floats option to wvunpack for correctly\n exporting un-normalized floating-point files\n- Update to version 5.3.0 \n * fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448\n * fixed: trailing garbage characters on imported ID3v2 TXXX tags\n * fixed: various minor undefined behavior and memory access issues\n * fixed: sanitize tag extraction names for length and path inclusion\n * improved: reformat wvunpack \u0027help\u0027 and split into long + short versions\n * added: regression testing to Travis CI for OSS-Fuzz crashers\n- Updated to version 5.2.0 \n *fixed: potential security issues including the following CVEs:\n CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344),\n CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342), \n CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), \n CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 \n and CVE-2019-1010319\n * added: support for CMake, Travis CI, and Google\u0027s OSS-fuzz\n * fixed: use correction file for encode verify (pipe input, Windows)\n * fixed: correct WAV header with actual length (pipe input, -i option)\n * fixed: thumb interworking and not needing v6 architecture (ARM asm)\n * added: handle more ID3v2.3 tag items and from all file types\n * fixed: coredump on Sparc64 (changed MD5 implementation)\n * fixed: handle invalid ID3v2.3 tags from sacd-ripper\n * fixed: several corner-case memory leaks\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2021-154",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0154-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2021:0154-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FD5IPNZ6LGJLORJOQVT3MAHBWF3ORQPT/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2021:0154-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FD5IPNZ6LGJLORJOQVT3MAHBWF3ORQPT/"
},
{
"category": "self",
"summary": "SUSE Bug 1091340",
"url": "https://bugzilla.suse.com/1091340"
},
{
"category": "self",
"summary": "SUSE Bug 1091341",
"url": "https://bugzilla.suse.com/1091341"
},
{
"category": "self",
"summary": "SUSE Bug 1091342",
"url": "https://bugzilla.suse.com/1091342"
},
{
"category": "self",
"summary": "SUSE Bug 1091343",
"url": "https://bugzilla.suse.com/1091343"
},
{
"category": "self",
"summary": "SUSE Bug 1091344",
"url": "https://bugzilla.suse.com/1091344"
},
{
"category": "self",
"summary": "SUSE Bug 1180414",
"url": "https://bugzilla.suse.com/1180414"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-10536 page",
"url": "https://www.suse.com/security/cve/CVE-2018-10536/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-10537 page",
"url": "https://www.suse.com/security/cve/CVE-2018-10537/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-10538 page",
"url": "https://www.suse.com/security/cve/CVE-2018-10538/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-10539 page",
"url": "https://www.suse.com/security/cve/CVE-2018-10539/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-10540 page",
"url": "https://www.suse.com/security/cve/CVE-2018-10540/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-19840 page",
"url": "https://www.suse.com/security/cve/CVE-2018-19840/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-19841 page",
"url": "https://www.suse.com/security/cve/CVE-2018-19841/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-6767 page",
"url": "https://www.suse.com/security/cve/CVE-2018-6767/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-7253 page",
"url": "https://www.suse.com/security/cve/CVE-2018-7253/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-7254 page",
"url": "https://www.suse.com/security/cve/CVE-2018-7254/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-1010319 page",
"url": "https://www.suse.com/security/cve/CVE-2019-1010319/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-11498 page",
"url": "https://www.suse.com/security/cve/CVE-2019-11498/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-35738 page",
"url": "https://www.suse.com/security/cve/CVE-2020-35738/"
}
],
"title": "Security update for wavpack",
"tracking": {
"current_release_date": "2026-09-20T19:20:42Z",
"generator": {
"date": "2021-01-24T17:22:08Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2021:0154-1",
"initial_release_date": "2021-01-24T17:22:08Z",
"revision_history": [
{
"date": "2021-01-24T17:22:08Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T19:20:42Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"product": {
"name": "libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"product_id": "libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"product_identification_helper": {
"cpe": "cpe:2.3:a:wavpack:wavpack:5.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libwavpack1@5.4.0-lp151.5.6.1?arch=i586\u0026upstream=wavpack-0:5.4.0-lp151.5.6.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wavpack-0:5.4.0-lp151.5.6.1.i586",
"product": {
"name": "wavpack-0:5.4.0-lp151.5.6.1.i586",
"product_id": "wavpack-0:5.4.0-lp151.5.6.1.i586",
"product_identification_helper": {
"cpe": "cpe:2.3:a:wavpack:wavpack:5.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/wavpack@5.4.0-lp151.5.6.1?arch=i586\u0026upstream=wavpack-0:5.4.0-lp151.5.6.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"product": {
"name": "wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"product_id": "wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"product_identification_helper": {
"cpe": "cpe:2.3:a:wavpack:wavpack:5.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/wavpack-devel@5.4.0-lp151.5.6.1?arch=i586\u0026upstream=wavpack-0:5.4.0-lp151.5.6.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"product": {
"name": "libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"product_id": "libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:wavpack:wavpack:5.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libwavpack1@5.4.0-lp151.5.6.1?arch=x86_64\u0026upstream=wavpack-0:5.4.0-lp151.5.6.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"product": {
"name": "libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"product_id": "libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:wavpack:wavpack:5.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libwavpack1-32bit@5.4.0-lp151.5.6.1?arch=x86_64\u0026upstream=wavpack-0:5.4.0-lp151.5.6.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"product": {
"name": "wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"product_id": "wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:wavpack:wavpack:5.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/wavpack@5.4.0-lp151.5.6.1?arch=x86_64\u0026upstream=wavpack-0:5.4.0-lp151.5.6.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64",
"product": {
"name": "wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64",
"product_id": "wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:wavpack:wavpack:5.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/wavpack-devel@5.4.0-lp151.5.6.1?arch=x86_64\u0026upstream=wavpack-0:5.4.0-lp151.5.6.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libwavpack1-0:5.4.0-lp151.5.6.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586"
},
"product_reference": "libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwavpack1-0:5.4.0-lp151.5.6.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64"
},
"product_reference": "libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64"
},
"product_reference": "libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wavpack-0:5.4.0-lp151.5.6.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586"
},
"product_reference": "wavpack-0:5.4.0-lp151.5.6.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wavpack-0:5.4.0-lp151.5.6.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64"
},
"product_reference": "wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wavpack-devel-0:5.4.0-lp151.5.6.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586"
},
"product_reference": "wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
},
"product_reference": "wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-10536",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-10536"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-10536",
"url": "https://www.suse.com/security/cve/CVE-2018-10536"
},
{
"category": "external",
"summary": "SUSE Bug 1091344 for CVE-2018-10536",
"url": "https://bugzilla.suse.com/1091344"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "important"
}
],
"title": "CVE-2018-10536"
},
{
"cve": "CVE-2018-10537",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-10537"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-10537",
"url": "https://www.suse.com/security/cve/CVE-2018-10537"
},
{
"category": "external",
"summary": "SUSE Bug 1091343 for CVE-2018-10537",
"url": "https://bugzilla.suse.com/1091343"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "important"
}
],
"title": "CVE-2018-10537"
},
{
"cve": "CVE-2018-10538",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-10538"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-10538",
"url": "https://www.suse.com/security/cve/CVE-2018-10538"
},
{
"category": "external",
"summary": "SUSE Bug 1091342 for CVE-2018-10538",
"url": "https://bugzilla.suse.com/1091342"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "moderate"
}
],
"title": "CVE-2018-10538"
},
{
"cve": "CVE-2018-10539",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-10539"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-10539",
"url": "https://www.suse.com/security/cve/CVE-2018-10539"
},
{
"category": "external",
"summary": "SUSE Bug 1091341 for CVE-2018-10539",
"url": "https://bugzilla.suse.com/1091341"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "moderate"
}
],
"title": "CVE-2018-10539"
},
{
"cve": "CVE-2018-10540",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-10540"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-10540",
"url": "https://www.suse.com/security/cve/CVE-2018-10540"
},
{
"category": "external",
"summary": "SUSE Bug 1091340 for CVE-2018-10540",
"url": "https://bugzilla.suse.com/1091340"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "moderate"
}
],
"title": "CVE-2018-10540"
},
{
"cve": "CVE-2018-19840",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-19840"
}
],
"notes": [
{
"category": "general",
"text": "The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-19840",
"url": "https://www.suse.com/security/cve/CVE-2018-19840"
},
{
"category": "external",
"summary": "SUSE Bug 1120930 for CVE-2018-19840",
"url": "https://bugzilla.suse.com/1120930"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "low"
}
],
"title": "CVE-2018-19840"
},
{
"cve": "CVE-2018-19841",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-19841"
}
],
"notes": [
{
"category": "general",
"text": "The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-19841",
"url": "https://www.suse.com/security/cve/CVE-2018-19841"
},
{
"category": "external",
"summary": "SUSE Bug 1120929 for CVE-2018-19841",
"url": "https://bugzilla.suse.com/1120929"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "low"
}
],
"title": "CVE-2018-19841"
},
{
"cve": "CVE-2018-6767",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-6767"
}
],
"notes": [
{
"category": "general",
"text": "A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-6767",
"url": "https://www.suse.com/security/cve/CVE-2018-6767"
},
{
"category": "external",
"summary": "SUSE Bug 1079746 for CVE-2018-6767",
"url": "https://bugzilla.suse.com/1079746"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "important"
}
],
"title": "CVE-2018-6767"
},
{
"cve": "CVE-2018-7253",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-7253"
}
],
"notes": [
{
"category": "general",
"text": "The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-7253",
"url": "https://www.suse.com/security/cve/CVE-2018-7253"
},
{
"category": "external",
"summary": "SUSE Bug 1081692 for CVE-2018-7253",
"url": "https://bugzilla.suse.com/1081692"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "moderate"
}
],
"title": "CVE-2018-7253"
},
{
"cve": "CVE-2018-7254",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-7254"
}
],
"notes": [
{
"category": "general",
"text": "The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-7254",
"url": "https://www.suse.com/security/cve/CVE-2018-7254"
},
{
"category": "external",
"summary": "SUSE Bug 1081693 for CVE-2018-7254",
"url": "https://bugzilla.suse.com/1081693"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "low"
}
],
"title": "CVE-2018-7254"
},
{
"cve": "CVE-2019-1010319",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-1010319"
}
],
"notes": [
{
"category": "general",
"text": "WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-1010319",
"url": "https://www.suse.com/security/cve/CVE-2019-1010319"
},
{
"category": "external",
"summary": "SUSE Bug 1141334 for CVE-2019-1010319",
"url": "https://bugzilla.suse.com/1141334"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "moderate"
}
],
"title": "CVE-2019-1010319"
},
{
"cve": "CVE-2019-11498",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-11498"
}
],
"notes": [
{
"category": "general",
"text": "WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a \"Conditional jump or move depends on uninitialised value\" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-11498",
"url": "https://www.suse.com/security/cve/CVE-2019-11498"
},
{
"category": "external",
"summary": "SUSE Bug 1133384 for CVE-2019-11498",
"url": "https://bugzilla.suse.com/1133384"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "low"
}
],
"title": "CVE-2019-11498"
},
{
"cve": "CVE-2020-35738",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-35738"
}
],
"notes": [
{
"category": "general",
"text": "WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later \"unofficial\" releases through 5.3.2, which are also affected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-35738",
"url": "https://www.suse.com/security/cve/CVE-2020-35738"
},
{
"category": "external",
"summary": "SUSE Bug 1180414 for CVE-2020-35738",
"url": "https://bugzilla.suse.com/1180414"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:libwavpack1-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:libwavpack1-32bit-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-0:5.4.0-lp151.5.6.1.x86_64",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.i586",
"openSUSE Leap 15.1:wavpack-devel-0:5.4.0-lp151.5.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-01-24T17:22:08Z",
"details": "important"
}
],
"title": "CVE-2020-35738"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.