Bug 1547735 (CVE-2018-7254)

Summary:	CVE-2018-7254 wavpack: Global buffer over-read in ParseCaffHeaderConfig function in cli/caff.c
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	lemenkov, mlichvar, sergio, valtri
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An out-of-bounds read flaw was found in the way WavPack handled processing of CAF (Core Audio Format) files. An attacker could potentially use this flaw to crash WavPack by tricking it into processing crafted CAF files.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-10-06 02:02:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1547736, 1547737, 1547738, 1547739
Bug Blocks:	1547741

Description Pedro Sampaio 2018-02-21 20:23:22 UTC

The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows an attacker to cause a denial-of-service due to global buffer over-read via a maliciously crafted CAF file.

Upstream bug:

https://github.com/dbry/WavPack/issues/26

Upstream patch:

https://github.com/dbry/WavPack/commit/8e3fe45a7bac31d9a3b558ae0079e2d92a04799e

Comment 1 Pedro Sampaio 2018-02-21 20:24:00 UTC

Created mingw-wavpack tracking bugs for this issue:

Affects: epel-7 [bug 1547737]
Affects: fedora-all [bug 1547736]


Created wavpack tracking bugs for this issue:

Affects: fedora-all [bug 1547738]

Comment 4 Sergio Basto 2018-10-06 02:02:29 UTC

https://src.fedoraproject.org/rpms/wavpack/c/be8d9f333fca9df19894a907d33aded11cb16cbc?branch=master