Critical Divide by Zero Vulnerability in WavPack Package
Summary
ALPINE-CVE-2019-1010315: WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. Affects wavpack versions < 5.1.0-r8. Fixed in 5.1.0-r8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WavPack is an open-source audio compression format that allows for lossless and lossy audio compression. It is widely used for its efficiency and high-quality output. However, versions 5.1 and earlier of WavPack are susceptible to a critical vulnerability that can lead to application crashes when processing maliciously crafted .wav files.
Vulnerability Detail
The vulnerability identified as CVE-2019-1010315 is a divide by zero error occurring in the ParseDsdiffHeaderConfig function within the dsdiff.c file of WavPack. This flaw can be exploited by attackers using specially crafted .wav files, potentially leading to unexpected crashes of software or services that attempt to parse these files. The impact of this vulnerability is significant, as it can disrupt services and affect user experience.
How To Fix
Minimum fixed version
5.1.0-r8
This is the first release that contains the fix.
sudo apk add --upgrade wavpackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted .wav files until the package is updated. Additionally, implementing input validation to check for file integrity before processing may mitigate the risk.
Conclusion
The WavPack package has a critical divide by zero vulnerability that can lead to application crashes when processing malicious .wav files. Users are advised to update to the latest patched version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for wavpack →
FAQ
The CVSS score for this vulnerability is 5.5, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Without requiring access to code or installation, you can check your application using a manifest file like package-lock.json.
Exploitation of this vulnerability can lead to application crashes, resulting in service disruptions and a negative user experience.
Yes, you can avoid processing untrusted .wav files and implement input validation to check for file integrity.
More information about WavPack can be found on its official website or its GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for wavpack.
