This update for wavpack fixes the following issues :

Update to version 5.4.0

  - CVE-2020-35738: Fixed an out-of-bounds write in     WavpackPackSamples (bsc#1180414)

  - fixed: disable A32 asm code when building for Apple     silicon

  - fixed: issues with Adobe-style floating-point WAV files

  - added: --normalize-floats option to wvunpack for     correctly exporting un-normalized floating-point files

Update to version 5.3.0

  - fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448

  - fixed: trailing garbage characters on imported ID3v2     TXXX tags

  - fixed: various minor undefined behavior and memory     access issues

  - fixed: sanitize tag extraction names for length and path     inclusion

  - improved: reformat wvunpack 'help' and split into long +     short versions

  - added: regression testing to Travis CI for OSS-Fuzz     crashers

Updated to version 5.2.0

*fixed: potential security issues including the following CVEs:
CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342), CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319

  - added: support for CMake, Travis CI, and Google's     OSS-fuzz

  - fixed: use correction file for encode verify (pipe     input, Windows)

  - fixed: correct WAV header with actual length (pipe     input, -i option)

  - fixed: thumb interworking and not needing v6     architecture (ARM asm)

  - added: handle more ID3v2.3 tag items and from all file     types

  - fixed: coredump on Sparc64 (changed MD5 implementation)

  - fixed: handle invalid ID3v2.3 tags from sacd-ripper

  - fixed: several corner-case memory leaks

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1581 advisory.

    - CVE-2018-19841
    - CVE-2019-1010317
    - CVE-2019-1010315
    - CVE-2019-11498
    - CVE-2018-19840

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0061 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2018-19840:
    The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to     cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file     because WavpackSetConfiguration64 mishandles a sample rate of zero.

    CVE-2018-19841:
    The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows     attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack     Lossless Audio file, as demonstrated by wvunpack.

    CVE-2019-1010315:
    WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to     sudden crash of a software/service that tries to parse a .wav file. The component is:
    ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed     version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.

    CVE-2019-1010317:
    WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is:
    Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The     attack vector is: Maliciously crafted .wav file. The fixed version is: After commit     https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.

    CVE-2019-1010319:
    WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is:
    Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211).
    The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit     https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.

    CVE-2019-11498:
    WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a Conditional jump     or move depends on uninitialised value condition, which might allow attackers to cause a denial of     service (application crash) via a DFF file that lacks valid sample-rate data.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
145253	SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2021:0186-1)	Nessus	SuSE Local Security Checks	2021/1/22	2024/1/26	high
180931	Oracle Linux 8 : wavpack (ELSA-2020-1581)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	medium
276391	TencentOS Server 3: wavpack (TSSA-2022:0061)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	medium

检测

插件搜索

high

medium

medium