CVE-2018-10536: High severity WavPack Wavpack vulnerability
An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wavpackto a version that resolves this vulnerability.Fixed in 5.4.0-1Fixed in 5.6.0-1Fixed in 5.8.1-1Fixed in 5.9.0-1 - Upgrade
Upgrade
alpine/wavpackto a version that resolves this vulnerability.Fixed in 5.1.0-r6 - Upgrade
Upgrade
alpine/wavpackto a version that resolves this vulnerability.Fixed in 5.1.0-r2
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10536?
CVE-2018-10536 is categorized as a vulnerability that allows writing to memory, which could lead to potential exploitation.
How do I fix CVE-2018-10536?
To mitigate CVE-2018-10536, upgrade to WavPack version 5.4.0 or later.
Which versions of WavPack are affected by CVE-2018-10536?
WavPack versions 5.1.0 and earlier are affected by CVE-2018-10536.
Is CVE-2018-10536 present in Debian Linux?
Yes, CVE-2018-10536 affects Debian Linux versions 8.0 and 9.0 with WavPack installed.
What impact does CVE-2018-10536 have on applications?
CVE-2018-10536 may allow an attacker to execute arbitrary code by exploiting the WAV parser vulnerability.