WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wavpack: out-of-bounds write in WavpackPackSamples function in pack_utils.c (CVE-2020-35738)

  - The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to     cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file     because WavpackSetConfiguration64 mishandles a sample rate of zero. (CVE-2018-19840)

  - A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log:
    AddressSanitizer:DEADLYSIGNAL     ===================================================================84257==ERROR: AddressSanitizer: SEGV on     unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The     signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0     0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-     gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can     not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING     (CVE-2022-2476)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:14669-1 advisory.

  - WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer     overflow in a malloc argument. NOTE: some third-parties claim that there are later unofficial releases     through 5.3.2, which are also affected. (CVE-2020-35738)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for wavpack fixes the following issues :

CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-2e2fc2eac6 advisory.

  - WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer     overflow in a malloc argument. NOTE: some third-parties claim that there are later unofficial releases     through 5.3.2, which are also affected. (CVE-2020-35738)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-b7826fcedf advisory.

  - WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer     overflow in a malloc argument. NOTE: some third-parties claim that there are later unofficial releases     through 5.3.2, which are also affected. (CVE-2020-35738)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-de45e7bb88 advisory.

  - WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer     overflow in a malloc argument. NOTE: some third-parties claim that there are later unofficial releases     through 5.3.2, which are also affected. (CVE-2020-35738)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - WavPack 5.3.0 has an out-of-bounds write in     WavpackPackSamples in pack_utils.c because of an     integer overflow in a malloc argument. NOTE: some     third-parties claim that there are later 'unofficial'     releases through 5.3.2, which are also     affected.(CVE-2020-35738)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wavpack fixes the following issues :

  - Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414) 

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

  - Update to version 5.3.0 

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

  - Updated to version 5.2.0 

    *fixed: potential security issues including the     following CVEs: CVE-2018-19840, CVE-2018-19841,     CVE-2018-10536 (bsc#1091344), CVE-2018-10537     (bsc#1091343) CVE-2018-10538 (bsc#1091342),     CVE-2018-10539 (bsc#1091341), CVE-2018-10540     (bsc#1091340), CVE-2018-7254, CVE-2018-7253,     CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

This update was imported from the SUSE:SLE-15:Update update project.

This update for wavpack fixes the following issues :

Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414)

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

Update to version 5.3.0

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

Updated to version 5.2.0

*fixed: potential security issues including the following CVEs:
CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342), CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-5c83efb61c advisory.

  - WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer     overflow in a malloc argument. NOTE: some third-parties claim that there are later unofficial releases     through 5.3.2, which are also affected. (CVE-2020-35738)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple vulnerabilites in wavpack were found, like OOB read (which could potentially lead to a DOS attack), unexpected control flow, crashes, integer overflow, and segfaults.

For Debian 9 stretch, these problems have been fixed in version 5.0.0-2+deb9u3.

We recommend that you upgrade your wavpack packages.

For the detailed security status of wavpack please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/wavpack

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New wavpack packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.

The wavpack project reports :

src/pack_utils.c - issue #91: fix integer overflows resulting in buffer overruns (CVE-2020-35738) - sanitize configuration parameters better (improves clarity and aids debugging)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4682-1 advisory.

    It was discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this     issue to execute arbitrary code or cause a crash.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199401	RHEL 8 : wavpack (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
150516	SUSE SLES11 Security Update : wavpack (SUSE-SU-2021:14669-1)	Nessus	SuSE Local Security Checks	medium
148144	SUSE SLES12 Security Update : wavpack (SUSE-SU-2021:0929-1)	Nessus	SuSE Local Security Checks	medium
146839	Fedora 32 : mingw-wavpack (2021-2e2fc2eac6)	Nessus	Fedora Local Security Checks	medium
146829	Fedora 33 : mingw-wavpack (2021-b7826fcedf)	Nessus	Fedora Local Security Checks	medium
146049	Fedora 32 : wavpack (2021-de45e7bb88)	Nessus	Fedora Local Security Checks	medium
145755	EulerOS 2.0 SP8 : wavpack (EulerOS-SA-2021-1177)	Nessus	Huawei Local Security Checks	medium
145376	openSUSE Security Update : wavpack (openSUSE-2021-154)	Nessus	SuSE Local Security Checks	high
145305	openSUSE Security Update : wavpack (openSUSE-2021-153)	Nessus	SuSE Local Security Checks	high
145253	SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2021:0186-1)	Nessus	SuSE Local Security Checks	high
145240	Fedora 33 : wavpack (2021-5c83efb61c)	Nessus	Fedora Local Security Checks	medium
145167	Debian DLA-2525-1 : wavpack security update	Nessus	Debian Local Security Checks	medium
145028	Slackware 14.0 / 14.1 / 14.2 / current : wavpack (SSA:2021-014-01)	Nessus	Slackware Local Security Checks	medium
145023	FreeBSD : wavpack -- integer overflow in pack_utils.c (6d554d6e-5638-11eb-9d36-5404a68ad561)	Nessus	FreeBSD Local Security Checks	medium
144789	Ubuntu 18.04 LTS / 20.04 LTS : WavPack vulnerability (USN-4682-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2020-35738

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

high

high

medium

medium

medium

medium

medium