CVE-2021-44269: Medium severity WavPack Wavpack vulnerability
A heap out of bounds read vulnerability was discovered in the function WavpackPackSamples(). https://github.com/dbry/WavPack/issues/110
Other sources
An out of bounds read was found in Wavpack 5.4.0 in processing .WAV files. This issue triggered in function WavpackPackSamples of file src/packutils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/wavpackto a version that resolves this vulnerability.Fixed in 5.5.0-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2021-44269?
The severity of CVE-2021-44269 is classified as medium due to the potential for exploitation causing out of bounds read conditions.
How do I fix CVE-2021-44269?
To fix CVE-2021-44269, it is recommended to upgrade Wavpack to version 5.4.1 or later where the issue has been addressed.
Which versions of Wavpack are affected by CVE-2021-44269?
CVE-2021-44269 affects Wavpack version 5.4.0.
What type of vulnerability is CVE-2021-44269?
CVE-2021-44269 is an out of bounds read vulnerability in Wavpack when processing certain WAV files.
Which operating systems are impacted by CVE-2021-44269?
CVE-2021-44269 impacts Fedora versions 34, 35, and 36 when running the affected Wavpack version.