PT-2018-3705 · Wavpack+7 · Wavpack+7
Published
2018-11-26
·
Updated
2024-06-15
·
CVE-2018-19840
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
WavPack versions through 5.1.0
Description
The issue is related to the function WavpackPackInit in the pack utils.c component of the WavPack audio codec. It is associated with an infinite loop. Exploitation of this issue allows a remote attacker to cause a denial-of-service via a specially crafted wav audio file. This is because the function WavpackSetConfiguration64 mishandles a sample rate of zero, leading to resource exhaustion.
Recommendations
For versions through 5.1.0, consider disabling the WavpackPackInit function or restricting the use of the pack utils.c component until a patch is available to prevent exploitation via crafted wav files. As a temporary workaround, avoid using sample rates of zero in the WavpackSetConfiguration64 function to minimize the risk of resource exhaustion.
Fix
DoS
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Ubuntu
Wavpack