PT-2022-6738 · Wavpack+5 · Wavpack+5

Xiaoxiaoafeifei · Published 2022-07-05 · Updated 2024-12-06 · CVE-2022-2476

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions WavPack version 5.4.0

Description A null pointer dereference bug was found in the main() function of the cli/wvunpack.c component of the WavPack audio codec. This bug allows an attacker to cause a denial of service using a specially crafted file. The issue is related to errors in pointer dereferencing.

Recommendations For WavPack version 5.4.0, as a temporary workaround, consider disabling the main() function in cli/wvunpack.c until a patch is available. However, since this is a critical component, it is recommended to wait for an official fix from the developers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2022-3448

ALT-PU-2023-1186

AZL-10317

BDU:2023-03843

CVE-2022-2476

MGASA-2022-0291

OESA-2024-2514

OESA-2024-2515

OESA-2024-2516

OESA-2024-2517

OPENSUSE-SU-2022_2681-1

SUSE-SU-2022:2681-1

SUSE-SU-2022:2682-1

SUSE-SU-2022_2681-1

SUSE-SU-2022_2682-1

USN-5721-1

Affected Products

Alt Linux

Astra Linux

Debian

Suse

Ubuntu

Wavpack

References · 38

• 🔥 https://github.com/dbry/WavPack/issues/121 · Exploit
• https://osv.dev/vulnerability/MGASA-2022-0291 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2476 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2682-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-2476 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5721-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2476 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-10317 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2517 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2515 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2514 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2681-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-2476 · Security Note