CVE-2018-10538: Medium severity WavPack Wavpack vulnerability
An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytestocopy calculation and subsequent malloc call, leading to insufficient memory allocation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10538?
CVE-2018-10538 is classified as a high severity vulnerability due to the potential for out-of-bounds writes and memory corruption.
How do I fix CVE-2018-10538?
To mitigate CVE-2018-10538, upgrade WavPack to version 5.4.0-1 or higher for Debian systems, or 5.1.0-2ubuntu0.3 for affected Ubuntu versions.
What systems are affected by CVE-2018-10538?
CVE-2018-10538 affects WavPack versions 5.1.0 and earlier across multiple distributions including Debian and Ubuntu.
What are the potential consequences of CVE-2018-10538?
Exploitation of CVE-2018-10538 can lead to application crashes and potential arbitrary code execution due to memory corruption.
Is CVE-2018-10538 specific to any file type?
Yes, CVE-2018-10538 specifically affects WAV input processed by the WavPack audio compression library.