openSUSE Security Update : wavpack (openSUSE-2021-153)

high Nessus Plugin ID 145305

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for wavpack fixes the following issues :

- Update to version 5.4.0

- CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414)

- fixed: disable A32 asm code when building for Apple silicon

- fixed: issues with Adobe-style floating-point WAV files

- added: --normalize-floats option to wvunpack for correctly exporting un-normalized floating-point files

- Update to version 5.3.0

- fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

- fixed: trailing garbage characters on imported ID3v2 TXXX tags

- fixed: various minor undefined behavior and memory access issues

- fixed: sanitize tag extraction names for length and path inclusion

- improved: reformat wvunpack 'help' and split into long + short versions

- added: regression testing to Travis CI for OSS-Fuzz crashers

- Updated to version 5.2.0

*fixed: potential security issues including the following CVEs: CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342), CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

- added: support for CMake, Travis CI, and Google's OSS-fuzz

- fixed: use correction file for encode verify (pipe input, Windows)

- fixed: correct WAV header with actual length (pipe input, -i option)

- fixed: thumb interworking and not needing v6 architecture (ARM asm)

- added: handle more ID3v2.3 tag items and from all file types

- fixed: coredump on Sparc64 (changed MD5 implementation)

- fixed: handle invalid ID3v2.3 tags from sacd-ripper

- fixed: several corner-case memory leaks

This update was imported from the SUSE:SLE-15:Update update project.

Solution

Update the affected wavpack packages.

Plugin Details

Severity: High

ID: 145305

File Name: openSUSE-2021-153.nasl

Version: 1.3

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 1/25/2021

Updated: 1/26/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2018-7254

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:libwavpack1, p-cpe:/a:novell:opensuse:libwavpack1-32bit, p-cpe:/a:novell:opensuse:libwavpack1-32bit-debuginfo, p-cpe:/a:novell:opensuse:libwavpack1-debuginfo, p-cpe:/a:novell:opensuse:wavpack, p-cpe:/a:novell:opensuse:wavpack-debuginfo, p-cpe:/a:novell:opensuse:wavpack-debugsource, p-cpe:/a:novell:opensuse:wavpack-devel, cpe:/o:novell:opensuse:15.2

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/24/2021

Vulnerability Publication Date: 2/6/2018

Reference Information

CVE: CVE-2018-10536, CVE-2018-10537, CVE-2018-10538, CVE-2018-10539, CVE-2018-10540, CVE-2018-19840, CVE-2018-19841, CVE-2018-6767, CVE-2018-7253, CVE-2018-7254, CVE-2019-1010319, CVE-2019-11498, CVE-2020-35738

Detections

Analytics