Bug 1547735 (CVE-2018-7254)

Summary: CVE-2018-7254 wavpack: Global buffer over-read in ParseCaffHeaderConfig function in cli/caff.c
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: lemenkov, mlichvar, sergio, valtri
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds read flaw was found in the way WavPack handled processing of CAF (Core Audio Format) files. An attacker could potentially use this flaw to crash WavPack by tricking it into processing crafted CAF files.
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-10-06 02:02:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1547736, 1547737, 1547738, 1547739    
Bug Blocks: 1547741    

Description Pedro Sampaio 2018-02-21 20:23:22 UTC
The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows an attacker to cause a denial-of-service due to global buffer over-read via a maliciously crafted CAF file.

Upstream bug:

https://github.com/dbry/WavPack/issues/26

Upstream patch:

https://github.com/dbry/WavPack/commit/8e3fe45a7bac31d9a3b558ae0079e2d92a04799e

Comment 1 Pedro Sampaio 2018-02-21 20:24:00 UTC
Created mingw-wavpack tracking bugs for this issue:

Affects: epel-7 [bug 1547737]
Affects: fedora-all [bug 1547736]


Created wavpack tracking bugs for this issue:

Affects: fedora-all [bug 1547738]