CVE-2018-10540: Medium severity WavPack Wavpack vulnerability
An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytestocopy calculation and subsequent malloc call, leading to insufficient memory allocation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10540?
CVE-2018-10540 is classified as a high severity vulnerability due to potential exploitation through out-of-bounds writes.
How do I fix CVE-2018-10540?
To fix CVE-2018-10540, update WavPack to version 5.4.0-1 or later if using Debian, or 5.1.0-2ubuntu0.3 or later for Ubuntu.
What systems are affected by CVE-2018-10540?
CVE-2018-10540 affects WavPack version 5.1.0 and earlier on Debian and Ubuntu operating systems.
What is the nature of the vulnerability in CVE-2018-10540?
CVE-2018-10540 involves a lack of validation for the sizes of unknown chunks, leading to possible out-of-bounds memory writes.
Can CVE-2018-10540 be exploited remotely?
Yes, CVE-2018-10540 can potentially be exploited remotely if an attacker can feed specially crafted data to WavPack.