Denial-of-Service Vulnerability in WavPack Package
Summary
ALPINE-CVE-2018-19841: The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio... Affects wavpack versions < 5.1.0-r7. Fixed in 5.1.0-r7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WavPack is an open-source audio compression format that provides lossless and lossy compression for audio files. It is widely used for its efficiency and quality in audio preservation. However, certain versions of WavPack are susceptible to a denial-of-service vulnerability that can be exploited through specially crafted audio files, leading to application crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2018-19841, exists in the function WavpackVerifySingleBlock within the open_utils.c file of the libwavpack.a library. It allows attackers to trigger an out-of-bounds read, resulting in a denial-of-service condition and application crashes when processing malicious WavPack Lossless Audio files. This vulnerability can be exploited without authentication, making it particularly dangerous.
How To Fix
Minimum fixed version
5.1.0-r7
This is the first release that contains the fix.
sudo apk add --upgrade wavpackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted WavPack files until the package is updated. Additionally, implementing input validation to check the integrity of audio files before processing may help mitigate the risk.
Conclusion
The WavPack package has a critical vulnerability (CVE-2018-19841) that can lead to denial-of-service attacks through crafted audio files. Users are advised to update to the latest patched versions to mitigate risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for wavpack →
FAQ
CVE-2018-19841 is a vulnerability in the WavPack package that allows attackers to cause a denial-of-service condition through specially crafted audio files.
If you are using WavPack versions prior to 5.1.0-r3 or 5.1.0-r7, depending on your Alpine version, you are likely affected by this vulnerability.
Exploiting this vulnerability can lead to application crashes, resulting in denial-of-service conditions for users processing malicious audio files.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for wavpack.
