Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1542550 - (CVE-2018-6767) CVE-2018-6767 wavpack: stack buffer overread via crafted wav file
CVE-2018-6767 wavpack: stack buffer overread via crafted wav file
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20180203,reported=2...
: Security
Depends On: 1542551 1542552 1543293
Blocks: 1542555
  Show dependency tree / graph
 
Reported: 2018-02-06 09:55 EST by Laura Pardo
Modified: 2018-02-14 23:13 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds stack buffer read flaw was found in WavPack. This flaw could potentially be used to crash WavPack CLI utilities by tricking them into processing specially crafted WAVE files.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Laura Pardo 2018-02-06 09:55:22 EST 
A flaw was found in wavpack 5.1.0-2. Running 'wavpack -y poc.wav' with a maliciously crafted file could cause the application to crash, which may allow an attacker to perform a denial-of-service attack.


Upstream bug:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889276
https://github.com/dbry/WavPack/issues/27

Upstream patch:
https://github.com/dbry/WavPack/commit/d5bf76b5a88d044a1be1d5656698e3ba737167e5
Comment 1 Laura Pardo 2018-02-06 09:55:55 EST 
Created mingw-wavpack tracking bugs for this issue:

Affects: epel-7 [bug 1542551]


Created wavpack tracking bugs for this issue:

Affects: fedora-all [bug 1542552]
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.