WavPack Vulnerability: Memory Write Issue in W64 Parser
Summary
ALPINE-CVE-2018-10537: An issue was discovered in WavPack 5.1.0 and earlier. Affects wavpack versions < 5.1.0-r6. Fixed in 5.1.0-r6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WavPack is an open-source audio compression format that provides lossless and lossy compression. It is widely used for its efficiency and high-quality audio output. The package is known for its ability to handle various audio formats and is utilized in numerous applications. However, a vulnerability has been identified in the W64 parser component, which can lead to potential memory corruption issues.
Vulnerability Detail
An issue was discovered in WavPack 5.1.0 and earlier versions. The vulnerability arises from the W64 parser component, specifically in the ParseWave64HeaderConfig function within wave64.c. This function fails to properly reject multiple format chunks, allowing for unintended memory writes. The ramifications of this vulnerability include potential crashes, data corruption, or arbitrary code execution, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
5.1.0-r6
This is the first release that contains the fix.
sudo apk add --upgrade wavpackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the W64 parser functionality until the package is updated. This may involve modifying application settings or using alternative audio processing methods that do not rely on the vulnerable component.
Conclusion
The WavPack vulnerability presents a significant risk due to its potential for memory corruption and arbitrary code execution. Users are strongly advised to update to the patched versions to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for wavpack →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
WavPack versions 5.1.0 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The potential consequences include memory corruption, application crashes, data loss, or arbitrary code execution.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for wavpack.
