PT-2019-5867 · Dbry+6 · Wavpack+6
Rohan Padhye
·
Publicado
2019-03-03
·
Atualizado
2024-06-15
·
CVE-2019-1010315
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
WavPack versions 5.1 and earlier
Description
The issue is related to a division by zero error in the ParseDsdiffHeaderConfig function of the dsdiff.c component in the WavPack audio codec. This can be exploited by a remote attacker using a malicious .wav file, leading to a denial of service through a crash. The component affected is ParseDsdiffHeaderConfig, and the attack vector involves a maliciously crafted .wav file.
Recommendations
For WavPack versions 5.1 and earlier, update to a version after the commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc to resolve the issue. As a temporary workaround, consider restricting the use of malicious .wav files to minimize the risk of exploitation.
Exploit
Correção
Divide By Zero
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Ubuntu
Wavpack