CVE-2018-6767: High severity WavPack Wavpack vulnerability
A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wavpackto a version that resolves this vulnerability.Fixed in 5.4.0-1Fixed in 5.6.0-1Fixed in 5.8.1-1Fixed in 5.9.0-2 - Upgrade
Upgrade
WavPackto a version that resolves this vulnerability.Fixed in 5.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6767?
CVE-2018-6767 has been rated as a security vulnerability that can lead to denial-of-service attacks.
How do I fix CVE-2018-6767?
To fix CVE-2018-6767, update WavPack to version 5.4.0-1 or higher, or apply the relevant patches from your OS vendor.
Which versions of WavPack are affected by CVE-2018-6767?
CVE-2018-6767 affects WavPack version 5.1.0 and earlier versions on various platforms.
Can CVE-2018-6767 be exploited remotely?
Yes, CVE-2018-6767 can be exploited remotely through a maliciously crafted RF64 file.
What impact does CVE-2018-6767 have on systems?
CVE-2018-6767 can cause a denial-of-service attack, potentially leading to application crashes or unresponsiveness.