CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2018-10536
https://notcve.org/view.php?id=CVE-2018-10536
An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks. Se ha descubierto un problema en WavPack 5.1.0 y anteriores. El componente de analizador WAV contiene una vulnerabilidad que permite la escritura en la memoria debido a que ParseRiffHeaderConfig en riff.c no rechaza múltiples fragmentos de formato. • http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html https://github.com/dbry/WavPack/commit/26cb47f99d481ad9b93eeff80d26e6b63bbd7e15 https://github.com/dbry/WavPack/issues/30 https://github.com/dbry/WavPack/issues/31 https://github.com/dbry/WavPack/issues/32 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKK • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 1CVE-2018-7254 – Wavpack 5.1.0 - Denial of Service
https://notcve.org/view.php?id=CVE-2018-7254
The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file. La función ParseCaffHeaderConfig del archivo cli/caff.c de WavPack 5.1.0 permite que un atacante remoto provoque una denegación de servicio (sobrelectura de búfer global) o que desencadene un desbordamiento de búfer o la asignación incorrecta de memoria mediante un archivo CAF maliciosamente manipulado. Wavpack version 5.1.0 suffers from a denial of service vulnerability. • https://www.exploit-db.com/exploits/44154 http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889274 https://github.com/dbry/WavPack/commit/8e3fe45a7bac31d9a3b558ae0079e2d92a04799e https://github.com/dbry/WavPack/issues/26 https://seclists.org/bugtraq/2019/Dec/37 https://usn.ubuntu.com/3578-1 https://www.debian.org/security/2018/dsa-4125 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2018-7253
https://notcve.org/view.php?id=CVE-2018-7253
The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file. La función ParseDsdiffHeaderConfig del archivo cli/dsdiff.c de WavPack 5.1.0 permite que un atacante remoto provoque una denegación de servicio (sobrelectura de búfer basada en memoria dinámica o heap) o sobrescriba el heap mediante un archivo DSDIFF maliciosamente manipulado. • http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889559 https://github.com/dbry/WavPack/commit/36a24c7881427d2e1e4dc1cef58f19eee0d13aec https://github.com/dbry/WavPack/issues/28 https://seclists.org/bugtraq/2019/Dec/37 https://usn.ubuntu.com/3578-1 https://www.debian.org/security/2018/dsa-4125 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 1CVE-2018-6767
https://notcve.org/view.php?id=CVE-2018-6767
A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file. Una sobrelectura de búfer basada en pila en la función ParseRiffHeaderConfig del archivo cli/riff.c de WavPack 5.1.0 permite que un atacante remoto provoque un ataque de denegación de servicio (DoS) o posiblemente otro impacto no especificado mediante un archivo RF64 manipulado maliciosamente. • http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889276 https://github.com/dbry/WavPack/commit/d5bf76b5a88d044a1be1d5656698e3ba737167e5 https://github.com/dbry/WavPack/issues/27 https://seclists.org/bugtraq/2019/Dec/37 https://usn.ubuntu.com/3568-1 https://www.debian.org/security/2018/dsa-4125 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10172
https://notcve.org/view.php?id=CVE-2016-10172
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file. La función read_new_config_info en open_utils.c en Wavpack en versiones anteriores a 5.1.0 permite a atacantes remotos provocar una denegación de servicio (lectura fuera de límites) a través de un archivo WV manipulado. • http://www.openwall.com/lists/oss-security/2017/01/28/9 http://www.securityfocus.com/bid/95883 https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc https://sourceforge.net/p/wavpack/mailman/message/35561951 • CWE-125: Out-of-bounds Read •