CVE-2018-10537: Buffer Overflow
An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wavpackto a version that resolves this vulnerability.Fixed in 5.4.0-1Fixed in 5.6.0-1Fixed in 5.8.1-1Fixed in 5.9.0-1 - Upgrade
Upgrade
alpine/wavpackto a version that resolves this vulnerability.Fixed in 5.1.0-r6 - Upgrade
Upgrade
alpine/wavpackto a version that resolves this vulnerability.Fixed in 5.1.0-r2
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10537?
CVE-2018-10537 has a high severity rating due to the potential for memory corruption vulnerabilities.
How do I fix CVE-2018-10537?
To fix CVE-2018-10537, upgrade to WavPack version 5.4.0 or later.
Which versions of WavPack are affected by CVE-2018-10537?
WavPack versions 5.1.0 and earlier are affected by CVE-2018-10537.
Are there specific distributions affected by CVE-2018-10537?
Yes, Debian 8.0, Debian 9.0, and certain Ubuntu versions are affected due to the vulnerable WavPack package.
What type of vulnerability is CVE-2018-10537 classified as?
CVE-2018-10537 is classified as a memory corruption vulnerability affecting the W64 parser component of WavPack.