CVE-2018-10537 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Wavpack

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-787 — Out-of-bounds Write12 documents8 sources
Severity
7.8HIGHNVD
EPSS
1.0%
top 23.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
WavpackDebian WavpackDebian Linux
Timeline
PublishedApr 29
Latest updateMay 13

Description

An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/wavpack< wavpack 5.1.0-3 (bookworm)
▶Debianwavpack/wavpack< 5.1.0-3+3
▶Ubuntuwavpack/wavpack< 5.1.0-2ubuntu1.1
▶NVDwavpack/wavpack5.1.0

Also affects: Debian Linux 8.0, 9.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-h93h-48cq-mpcw: An issue was discovered in WavPack 5↗2022-05-13
▶
OSV
wavpack vulnerabilities↗2018-04-30
▶
OSV
CVE-2018-10537: An issue was discovered in WavPack 5↗2018-04-29
▶

📋Vendor Advisories

3
Ubuntu
WavPack vulnerabilities↗2018-04-30
▶
Red Hat
wavpack: out of bounds write in ParseWave64HeaderConfig in wave64.c↗2018-04-22
▶
Debian
CVE-2018-10537: wavpack - An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component c...↗2018
▶

📄Research Papers

1
arXiv
Smart Greybox Fuzzing↗2018-11-23
▶

💬Community

4
Bugzilla
CVE-2018-10537 wavpack: out of bounds write in ParseWave64HeaderConfig in wave64.c↗2018-05-03
▶
Bugzilla
CVE-2018-10536 CVE-2018-10537 CVE-2018-10538 CVE-2018-10539 CVE-2018-10540 mingw-wavpack: various flaws [epel-7]↗2018-05-03
▶
Bugzilla
CVE-2018-10536 CVE-2018-10537 CVE-2018-10538 CVE-2018-10539 CVE-2018-10540 wavpack: various flaws [fedora-all]↗2018-05-03
▶
Bugzilla
CVE-2018-10536 CVE-2018-10537 CVE-2018-10538 CVE-2018-10539 CVE-2018-10540 mingw-wavpack: various flaws [fedora-all]↗2018-05-03
▶