Attachment 193274 Details for Bug 228146 – patch file

[patch] patch file

security_vuxml.patch (text/plain), 4.54 KB, created by Yasuhiro Kimura on 2018-05-11 08:30:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Yasuhiro Kimura

Created: 2018-05-11 08:30:00 UTC

Size: 4.54 KB

patch

obsolete

>Index: vuln.xml
>===================================================================
>--- vuln.xml	(revision 469606)
>+++ vuln.xml	(working copy)
>@@ -58,6 +58,63 @@
> * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+ <vuln vid="50210bc1-54ef-11e8-95d9-9c5c8e75236a">
>+ <topic>wavpack -- multiple vulnerabilities</topic>
>+ <affects>
>+ <package>
>+	<name>wavpack</name>
>+	<range><lt>5.1.0_1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	Sebastian Ramacher reports:
>+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767">
>+	 A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.
>+	</blockquote>
>+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253">
>+	 The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.
>+	</blockquote>
>+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254">
>+	 The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.
>+	</blockquote>
>+	Thuan Pham reports:
>+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536">
>+	 An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.
>+	</blockquote>
>+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537">
>+	 An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.
>+	</blockquote>
>+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538">
>+	 An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
>+	</blockquote>
>+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539">
>+	 An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
>+	</blockquote>
>+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540">
>+	 An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2018-6767</cvename>
>+ <cvename>CVE-2018-7253</cvename>
>+ <cvename>CVE-2018-7254</cvename>
>+ <cvename>CVE-2018-10536</cvename>
>+ <cvename>CVE-2018-10537</cvename>
>+ <cvename>CVE-2018-10538</cvename>
>+ <cvename>CVE-2018-10539</cvename>
>+ <cvename>CVE-2018-10540</cvename>
>+ <url>https://www.debian.org/security/2018/dsa-4125</url>
>+ <url>https://www.debian.org/security/2018/dsa-4197</url>
>+ <freebsdpr>228141</freebsdpr>
>+ </references>
>+ <dates>
>+ <discovery>2018-05-09</discovery>
>+ <entry>2018-05-11</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="06ab7724-0fd7-427e-a5ce-fe436302b10c">
> <topic>jenkins -- multiple vulnerabilities</topic>
> <affects>

Actions: View | Diff

Attachments on bug 228146: 193274