CVE-2018-10539: Medium severity WavPack Wavpack vulnerability
An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytestocopy calculation and subsequent malloc call, leading to insufficient memory allocation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10539?
CVE-2018-10539 is classified as a medium-severity vulnerability due to its potential for causing out-of-bounds writes.
How do I fix CVE-2018-10539?
To fix CVE-2018-10539, upgrade WavPack to version 5.4.0-1 or later for Debian or to version 5.1.0-2ubuntu0.3 or later for Ubuntu.
Which versions of WavPack are affected by CVE-2018-10539?
CVE-2018-10539 affects WavPack versions 5.1.0 and earlier.
What software is impacted by CVE-2018-10539?
CVE-2018-10539 impacts WavPack across various distributions including specific versions in Debian and Ubuntu.
Is there a patch available for CVE-2018-10539?
Yes, patches are available by upgrading to the specified secure versions of WavPack.