Out-of-Bounds Write Vulnerability in WavPack Package
Summary
ALPINE-CVE-2018-10539: An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Affects wavpack versions < 5.1.0-r6. Fixed in 5.1.0-r6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WavPack is an open-source audio compression format that provides high-quality lossless and lossy audio compression. It is widely used for its efficiency and flexibility in handling various audio formats. However, certain versions of WavPack are vulnerable to a critical issue that can lead to memory corruption and potential exploitation.
Vulnerability Detail
An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because the function ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation. This lack of validation can lead to insufficient memory allocation due to integer overflow in the bytes_to_copy calculation, resulting in memory corruption and potential exploitation by attackers.
How To Fix
Minimum fixed version
5.1.0-r6
This is the first release that contains the fix.
sudo apk add --upgrade wavpackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider disabling the use of DSDiff input in your application until the package can be updated.
Conclusion
The WavPack package has a critical vulnerability that can lead to out-of-bounds writes due to improper validation of DSDiff input. It is essential to update to the patched versions to mitigate the risk of exploitation. Users should also consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for wavpack →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
WavPack versions 5.1.0 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to memory corruption, which may allow attackers to execute arbitrary code or crash the application.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for wavpack.
