Denial of Service Vulnerability in WavPack Package - CVE-2019-11498
Summary
ALPINE-CVE-2019-11498: WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (appl... Affects wavpack versions < 5.1.0-r8. Fixed in 5.1.0-r8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WavPack is an open-source audio compression format that provides lossless and lossy compression. It is widely used for its efficiency in compressing audio files while maintaining high quality. However, certain versions of WavPack are susceptible to a vulnerability that can lead to application crashes when processing specific audio files.
Vulnerability Detail
The vulnerability identified as CVE-2019-11498 affects WavPack versions up to 5.1.0. It originates from the WavpackSetConfiguration64 function in the pack_utils.c file, where a conditional jump or move depends on an uninitialized value. This flaw can be exploited by attackers using DFF files that lack valid sample-rate data, potentially causing a denial of service by crashing the application. The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk.
How To Fix
Minimum fixed version
5.1.0-r8
This is the first release that contains the fix.
sudo apk add --upgrade wavpackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing DFF files that do not contain valid sample-rate data until the package is updated to a secure version.
Conclusion
The vulnerability CVE-2019-11498 in the WavPack package poses a risk of denial of service through specific audio files. Users are advised to update to the latest patched versions to mitigate this risk and can utilize Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for wavpack →
FAQ
CVE-2019-11498 is a vulnerability in the WavPack package that can lead to application crashes when processing certain audio files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
WavPack versions prior to 5.1.0 are vulnerable to this issue, with specific fixes available in versions 5.1.0-r4 and 5.1.0-r8 depending on the Alpine version.
If an immediate update is not possible, refrain from using DFF files that lack valid sample-rate data to mitigate the risk of a crash.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using just a manifest file. It provides real-time insights without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for wavpack.
