The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wavpack: out-of-bounds write in WavpackPackSamples function in pack_utils.c (CVE-2020-35738)

  - The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to     cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file     because WavpackSetConfiguration64 mishandles a sample rate of zero. (CVE-2018-19840)

  - A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log:
    AddressSanitizer:DEADLYSIGNAL     ===================================================================84257==ERROR: AddressSanitizer: SEGV on     unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The     signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0     0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-     gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can     not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING     (CVE-2022-2476)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wavpack: out of bounds write in ParseRiffHeaderConfig in riff.c (CVE-2018-10536)

  - The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial     of service (out-of-bounds read) via a crafted WV file. (CVE-2016-10169)

  - An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because     ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory     allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and     subsequent malloc call, leading to insufficient memory allocation. (CVE-2018-10538)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wavpack: out of bounds write in ParseRiffHeaderConfig in riff.c (CVE-2018-10536)

  - The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial     of service (out-of-bounds read) via a crafted WV file. (CVE-2016-10169)

  - An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because     ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory     allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and     subsequent malloc call, leading to insufficient memory allocation. (CVE-2018-10538)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:1581 advisory.

  - The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to     cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file     because WavpackSetConfiguration64 mishandles a sample rate of zero. (CVE-2018-19840)

  - The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows     attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack     Lossless Audio file, as demonstrated by wvunpack. (CVE-2018-19841)

  - WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to     sudden crash of a software/service that tries to parse a .wav file. The component is:
    ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed     version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.
    (CVE-2019-1010315)

  - WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is:
    Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The     attack vector is: Maliciously crafted .wav file. The fixed version is: After commit     https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b. (CVE-2019-1010317)

  - WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is:
    Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211).
    The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit     https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe. (CVE-2019-1010319)

  - WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a Conditional jump     or move depends on uninitialised value condition, which might allow attackers to cause a denial of     service (application crash) via a DFF file that lacks valid sample-rate data. (CVE-2019-11498)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3839-1 advisory.

    It was discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this     issue to cause a denial of service. (CVE-2018-19840, CVE-2018-19841)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1581 advisory.

    - CVE-2018-19841
    - CVE-2019-1010317
    - CVE-2019-1010315
    - CVE-2019-11498
    - CVE-2018-19840

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:1581 advisory.

  - The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to     cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file     because WavpackSetConfiguration64 mishandles a sample rate of zero. (CVE-2018-19840)

  - The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows     attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack     Lossless Audio file, as demonstrated by wvunpack. (CVE-2018-19841)

  - WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a Conditional jump     or move depends on uninitialised value condition, which might allow attackers to cause a denial of     service (application crash) via a DFF file that lacks valid sample-rate data. (CVE-2019-11498)

  - WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to     sudden crash of a software/service that tries to parse a .wav file. The component is:
    ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed     version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.
    (CVE-2019-1010315)

  - WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is:
    Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The     attack vector is: Maliciously crafted .wav file. The fixed version is: After commit     https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b. (CVE-2019-1010317)

  - WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is:
    Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211).
    The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit     https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe. (CVE-2019-1010319)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1581 advisory.

  - wawpack: Infinite loop in WavpackPackInit function lead to DoS (CVE-2018-19840)

  - wawpack: Out-of-bounds read in WavpackVerifySingleBlock function leads to DoS (CVE-2018-19841)

  - wavpack: Divide by zero in ParseDsdiffHeaderConfig leads to crash (CVE-2019-1010315)

  - wavpack: Use of uninitialized variable in ParseCaffHeaderConfig leads to DoS (CVE-2019-1010317)

  - wavpack: Use of uninitialized variable in ParseWave64HeaderConfig leads to DoS (CVE-2019-1010319)

  - wavpack: Use of uninitialized variable in WavpackSetConfiguration64 leads to DoS (CVE-2019-11498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for wavpack fixes the following issues :

  - Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414) 

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

  - Update to version 5.3.0 

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

  - Updated to version 5.2.0 

    *fixed: potential security issues including the     following CVEs: CVE-2018-19840, CVE-2018-19841,     CVE-2018-10536 (bsc#1091344), CVE-2018-10537     (bsc#1091343) CVE-2018-10538 (bsc#1091342),     CVE-2018-10539 (bsc#1091341), CVE-2018-10540     (bsc#1091340), CVE-2018-7254, CVE-2018-7253,     CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

This update was imported from the SUSE:SLE-15:Update update project.

This update for wavpack fixes the following issues :

Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414)

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

Update to version 5.3.0

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

Updated to version 5.2.0

*fixed: potential security issues including the following CVEs:
CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342), CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilites in wavpack were found, like OOB read (which could potentially lead to a DOS attack), unexpected control flow, crashes, integer overflow, and segfaults.

For Debian 9 stretch, these problems have been fixed in version 5.0.0-2+deb9u3.

We recommend that you upgrade your wavpack packages.

For the detailed security status of wavpack please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/wavpack

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wavpack fixes the following issues :

Security issues fixed :

CVE-2018-19840: Fixed a denial-of-service in the WavpackPackInit function from pack_utils.c (bsc#1120930)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1581 advisory.

    WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique     hybrid compression mode.

    Security Fix(es):

    * wawpack: Infinite loop in WavpackPackInit function lead to DoS (CVE-2018-19840)

    * wawpack: Out-of-bounds read in WavpackVerifySingleBlock function leads to DoS (CVE-2018-19841)

    * wavpack: Use of uninitialized variable in WavpackSetConfiguration64 leads to DoS (CVE-2019-11498)

    * wavpack: Divide by zero in ParseDsdiffHeaderConfig leads to crash (CVE-2019-1010315)

    * wavpack: Use of uninitialized variable in ParseCaffHeaderConfig leads to DoS (CVE-2019-1010317)

    * wavpack: Use of uninitialized variable in ParseWave64HeaderConfig leads to DoS (CVE-2019-1010319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202007-19 (WavPack: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WavPack. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted audio file possibly       resulting in a Denial of Service condition. Please review the referenced       CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Security fixes for: CVE-2018-10536 CVE-2018-10537 CVE-2018-10538 CVE-2018-10539 CVE-2018-10540 CVE-2018-19840 CVE-2018-19841 CVE-2019-11498 CVE-2019-1010315 CVE-2019-1010319 CVE-2019-1010317

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New wavpack packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

According to the versions of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The function WavpackPackInit in pack_utils.c in     libwavpack.a in WavPack through 5.1.0 allows attackers     to cause a denial-of-service (resource exhaustion     caused by an infinite loop) via a crafted wav audio     file because WavpackSetConfiguration64 mishandles a     sample rate of zero.(CVE-2018-19840)

  - The read_code function in read_words.c in Wavpack     before 5.1.0 allows remote attackers to cause a denial     of service (out-of-bounds read) via a crafted WV     file.(CVE-2016-10169)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The function WavpackPackInit in pack_utils.c in     libwavpack.a in WavPack through 5.1.0 allows attackers     to cause a denial-of-service (resource exhaustion     caused by an infinite loop) via a crafted wav audio     file because WavpackSetConfiguration64 mishandles a     sample rate of zero.(CVE-2018-19840)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The function WavpackVerifySingleBlock in open_utils.c     in libwavpack.a in WavPack through 5.1.0 allows     attackers to cause a denial-of-service (out-of-bounds     read and application crash) via a crafted WavPack     Lossless Audio file, as demonstrated by     wvunpack.(CVE-2018-19841)

  - The function WavpackPackInit in pack_utils.c in     libwavpack.a in WavPack through 5.1.0 allows attackers     to cause a denial-of-service (resource exhaustion     caused by an infinite loop) via a crafted wav audio     file because WavpackSetConfiguration64 mishandles a     sample rate of zero.(CVE-2018-19840)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix for CVE-2018-19840 CVE-2018-19841

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wavpack fixes the following issues :

Security issues fixed :

  - CVE-2018-19840: Fixed a denial-of-service in the     WavpackPackInit function from pack_utils.c (bsc#1120930)

  - CVE-2018-19841: Fixed a denial-of-service in the     WavpackVerifySingleBlock function from open_utils.c     (bsc#1120929)

This update was imported from the SUSE:SLE-15:Update update project.

This update for wavpack fixes the following issues :

Security issues fixed :

CVE-2018-19840: Fixed a denial-of-service in the WavpackPackInit function from pack_utils.c (bsc#1120930)

CVE-2018-19841: Fixed a denial-of-service in the WavpackVerifySingleBlock function from open_utils.c (bsc#1120929)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199401	RHEL 8 : wavpack (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199329	RHEL 7 : wavpack (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199288	RHEL 6 : wavpack (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
184911	Rocky Linux 8 : wavpack (RLSA-2020:1581)	Nessus	Rocky Linux Local Security Checks	medium
183599	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : WavPack vulnerabilities (USN-3839-1)	Nessus	Ubuntu Local Security Checks	medium
180931	Oracle Linux 8 : wavpack (ELSA-2020-1581)	Nessus	Oracle Linux Local Security Checks	medium
157602	AlmaLinux 8 : wavpack (ALSA-2020:1581)	Nessus	Alma Linux Local Security Checks	medium
145884	CentOS 8 : wavpack (CESA-2020:1581)	Nessus	CentOS Local Security Checks	medium
145376	openSUSE Security Update : wavpack (openSUSE-2021-154)	Nessus	SuSE Local Security Checks	high
145305	openSUSE Security Update : wavpack (openSUSE-2021-153)	Nessus	SuSE Local Security Checks	high
145253	SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2021:0186-1)	Nessus	SuSE Local Security Checks	high
145167	Debian DLA-2525-1 : wavpack security update	Nessus	Debian Local Security Checks	medium
143789	SUSE SLES12 Security Update : wavpack (SUSE-SU-2020:2727-1)	Nessus	SuSE Local Security Checks	medium
143040	RHEL 8 : wavpack (RHSA-2020:1581)	Nessus	Red Hat Local Security Checks	medium
138942	GLSA-202007-19 : WavPack: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
132878	Fedora 31 : mingw-wavpack (2020-e55567b6be)	Nessus	Fedora Local Security Checks	high
132877	Fedora 30 : mingw-wavpack (2020-73274c9df4)	Nessus	Fedora Local Security Checks	high
132333	Slackware 14.0 / 14.1 / 14.2 / current : wavpack (SSA:2019-353-01)	Nessus	Slackware Local Security Checks	high
132215	EulerOS 2.0 SP3 : wavpack (EulerOS-SA-2019-2680)	Nessus	Huawei Local Security Checks	medium
128824	EulerOS 2.0 SP5 : wavpack (EulerOS-SA-2019-1901)	Nessus	Huawei Local Security Checks	medium
128797	EulerOS 2.0 SP2 : wavpack (EulerOS-SA-2019-1874)	Nessus	Huawei Local Security Checks	medium
128200	EulerOS 2.0 SP8 : wavpack (EulerOS-SA-2019-1831)	Nessus	Huawei Local Security Checks	medium
124472	Fedora 30 : wavpack (2019-1315f2dc3a)	Nessus	Fedora Local Security Checks	medium
124244	Fedora 28 : wavpack (2019-235c682f35)	Nessus	Fedora Local Security Checks	medium
124066	Fedora 29 : wavpack (2019-88f264563f)	Nessus	Fedora Local Security Checks	medium
123775	openSUSE Security Update : wavpack (openSUSE-2019-1145)	Nessus	SuSE Local Security Checks	medium
123453	SUSE SLES11 Security Update : wavpack (SUSE-SU-2019:13990-1)	Nessus	SuSE Local Security Checks	medium
123448	SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2019:0772-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-19840

medium

Tenable Plugins

medium

high

high

medium

medium

medium

medium

medium

high

high

high

medium

medium

medium

medium

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium