View | Details | Raw Unified | Return to bug 228146
Collapse All | Expand All

(-)vuln.xml (+57 lines)
Lines 58-63 Link Here
58 
  * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 58 
  * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
59 
-->
 59 
-->
60 
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
 60 
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
61 
  <vuln vid="50210bc1-54ef-11e8-95d9-9c5c8e75236a">
62 
    <topic>wavpack -- multiple vulnerabilities</topic>
63 
    <affects>
64 
      <package>
65 
	<name>wavpack</name>
66 
	<range><lt>5.1.0_1</lt></range>
67 
      </package>
68 
    </affects>
69 
    <description>
70 
      <body xmlns="http://www.w3.org/1999/xhtml">
71 
	<p>Sebastian Ramacher reports:</p>
72 
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767">
73 
	  <p>A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.</p>
74 
	</blockquote>
75 
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253">
76 
	  <p>The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.</p>
77 
	</blockquote>
78 
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254">
79 
	  <p>The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.</p>
80 
	</blockquote>
81 
	<p>Thuan Pham reports:</p>
82 
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536">
83 
	  <p>An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.</p>
84 
	</blockquote>
85 
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537">
86 
	  <p>An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.</p>
87 
	</blockquote>
88 
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538">
89 
	  <p>An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
90 
	</blockquote>
91 
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539">
92 
	  <p>An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
93 
	</blockquote>
94 
	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540">
95 
	  <p>An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
96 
	</blockquote>
97 
      </body>
98 
    </description>
99 
    <references>
100 
      <cvename>CVE-2018-6767</cvename>
101 
      <cvename>CVE-2018-7253</cvename>
102 
      <cvename>CVE-2018-7254</cvename>
103 
      <cvename>CVE-2018-10536</cvename>
104 
      <cvename>CVE-2018-10537</cvename>
105 
      <cvename>CVE-2018-10538</cvename>
106 
      <cvename>CVE-2018-10539</cvename>
107 
      <cvename>CVE-2018-10540</cvename>
108 
      <url>https://www.debian.org/security/2018/dsa-4125</url>
109 
      <url>https://www.debian.org/security/2018/dsa-4197</url>
110 
      <freebsdpr>228141</freebsdpr>
111 
    </references>
112 
    <dates>
113 
      <discovery>2018-05-09</discovery>
114 
      <entry>2018-05-11</entry>
115 
    </dates>
116 
  </vuln>
117 

            

        

          61
          
  <vuln vid="06ab7724-0fd7-427e-a5ce-fe436302b10c">

          118
          
  <vuln vid="06ab7724-0fd7-427e-a5ce-fe436302b10c">

        

        

          62
          
    <topic>jenkins -- multiple vulnerabilities</topic>

          119
          
    <topic>jenkins -- multiple vulnerabilities</topic>

        

        

          63
          
    <affects>

          120
          
    <affects>

        






  

  Return to bug 228146