CVE-2022-2476
published 2022-07-19CVE-2022-2476: A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL…
PriorityP418medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.37%
29.4th percentile
A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wavpack | < wavpack 5.5.0-1 (bookworm) | wavpack 5.5.0-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_wavpack_5.6.0-1_on_cbl_mariner_2.0 | — | — |
| wavpack | wavpack | — | — |
| wavpack | wavpack | — | — |
| wavpack | wavpack | >= 0 < 5.5.0-1 | 5.5.0-1 |
| wavpack | wavpack | >= 0 < 5.5.0-1 | 5.5.0-1 |
| wavpack | wavpack | >= 0 < 5.5.0-1 | 5.5.0-1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
WavPack vulnerability
vendor_ubuntu·2022-11-10
CVE-2022-2476 WavPack vulnerability
Title: WavPack vulnerability
Summary: WavPack could be made to crash if it opened a specially crafted
file.
It was discovered that WavPack was not properly performing checks
when dealing with memory. If a user were tricked into decompressing a
specially crafted WavPack Audio File, an attacker could possibly use
this issue to cause the WavPack decompressor to crash, resulting in a
denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
wavpack: null pointer dereference in main() in cli/wvunpack.c
vendor_redhat·2022-07-19·CVSS 5.5
CVE-2022-2476 [MEDIUM] CWE-476 wavpack: null pointer dereference in main() in cli/wvunpack.c
wavpack: null pointer dereference in main() in cli/wvunpack.c
A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING
A
Microsoft
A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR:
vendor_msrc·2022-07-12·CVSS 5.5
CVE-2022-2476 [MEDIUM] CWE-476 A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR:
A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING
FAQ: Is Azure Linux the only Microsoft product that includes this
Debian
CVE-2022-2476: wavpack - A null pointer dereference bug was found in wavpack-5.4.0 The results from the A...
vendor_debian·2022·CVSS 5.5
CVE-2022-2476 [MEDIUM] CVE-2022-2476: wavpack - A null pointer dereference bug was found in wavpack-5.4.0 The results from the A...
A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING
Scope: local
bookworm: resolved (fixed in 5.5.0-1)
bullseye: open
VulDB
wavpack 5.4.0 cli/wvunpack.c null pointer dereference (Issue 121 / EUVD-2022-34735)
vuldb·2026-05-25·CVSS 5.5
CVE-2022-2476 [MEDIUM] wavpack 5.4.0 cli/wvunpack.c null pointer dereference (Issue 121 / EUVD-2022-34735)
A vulnerability was found in wavpack 5.4.0. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the file cli/wvunpack.c. The manipulation leads to null pointer dereference.
This vulnerability is referenced as CVE-2022-2476. Remote exploitation of the attack is possible. No exploit is available.
GHSA
GHSA-62q3-hj99-8qw6: A null pointer dereference bug was found in wavpack-5
ghsa_unreviewed·2022-07-20
CVE-2022-2476 [MEDIUM] CWE-476 GHSA-62q3-hj99-8qw6: A null pointer dereference bug was found in wavpack-5
A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING
OSV
CVE-2022-2476: A null pointer dereference bug was found in wavpack-5
osv·2022-07-19·CVSS 5.5
CVE-2022-2476 [MEDIUM] CVE-2022-2476: A null pointer dereference bug was found in wavpack-5
A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/dbry/WavPack/issues/121https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CK45CC7MQ54SHEIJ63PW3HP4BCPTX6QP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMIXZWB3OURGBAEU3T5HQY56BN2ZVLYF/https://github.com/dbry/WavPack/issues/121https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CK45CC7MQ54SHEIJ63PW3HP4BCPTX6QP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMIXZWB3OURGBAEU3T5HQY56BN2ZVLYF/
2022-07-19
Published