PT-2019-5869 · Dbry+8 · Wavpack+8
Rohan Padhye
·
Publicado
2019-03-05
·
Atualizado
2024-06-15
·
CVE-2019-1010319
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
WavPack versions 5.1.0 and earlier
Description
The issue is related to the use of uninitialized variables in the ParseWave64HeaderConfig component of the WavPack audio codec. This can lead to unexpected control flow, crashes, and segfaults when a maliciously crafted .wav file is processed. The attack vector is a malicious .wav file.
Recommendations
For WavPack versions 5.1.0 and earlier, update to a version after commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe to resolve the issue. As a temporary workaround, consider avoiding the use of the ParseWave64HeaderConfig function until a patch is available. Restrict access to malicious .wav files to minimize the risk of exploitation.
Exploit
Correção
Use of Uninitialized Resource
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Red Hat
Rocky Linux
Suse
Ubuntu
Wavpack