PT-2018-3705 · Wavpack+7 · Wavpack+7
Publicado
2018-11-26
·
Atualizado
2024-06-15
·
CVE-2018-19840
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
WavPack versions through 5.1.0
Description
The issue is related to the function WavpackPackInit in the pack utils.c component of the WavPack audio codec. It is associated with an infinite loop. Exploitation of this issue allows a remote attacker to cause a denial-of-service via a specially crafted wav audio file. This is because the function WavpackSetConfiguration64 mishandles a sample rate of zero, leading to resource exhaustion.
Recommendations
For versions through 5.1.0, consider disabling the WavpackPackInit function or restricting the use of the pack utils.c component until a patch is available to prevent exploitation via crafted wav files. As a temporary workaround, avoid using sample rates of zero in the WavpackSetConfiguration64 function to minimize the risk of resource exhaustion.
Correção
DoS
Infinite Loop
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Ubuntu
Wavpack