rpm package
suse/wavpack&distro=SUSE Linux Enterprise Software Development Kit 12 SP5
pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-2476 | — | < 4.60.99-5.12.1 | 4.60.99-5.12.1 | Jul 19, 2022 | A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0 | ||
| CVE-2020-35738 | — | < 4.60.99-5.9.1 | 4.60.99-5.9.1 | Dec 28, 2020 | WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected. | ||
| CVE-2018-19840 | — | < 4.60.99-5.6.3 | 4.60.99-5.6.3 | Dec 4, 2018 | The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero. |
- CVE-2022-2476Jul 19, 2022affected < 4.60.99-5.12.1fixed 4.60.99-5.12.1
A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0
- CVE-2020-35738Dec 28, 2020affected < 4.60.99-5.9.1fixed 4.60.99-5.9.1
WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.
- CVE-2018-19840Dec 4, 2018affected < 4.60.99-5.6.3fixed 4.60.99-5.6.3
The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.