Bug 1547735 – CVE-2018-7254 wavpack: Global buffer over-read in ParseCaffHeaderConfig function in cli/caff.c

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1547735 - (CVE-2018-7254) CVE-2018-7254 wavpack: Global buffer over-read in ParseCaffHeaderConfig function in cli/caff.c

Summary:	CVE-2018-7254 wavpack: Global buffer over-read in ParseCaffHeaderConfig funct...

Status:	CLOSED ERRATA

Aliases:	CVE-2018-7254

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180219,reported=2...
Keywords:	Security

Depends On:	1547736 1547737 1547738 1547739
Blocks:	1547741
	Show dependency tree / graph

Reported:	2018-02-21 15:23 EST by Pedro Sampaio
Modified:	2018-10-05 22:02 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	An out-of-bounds read flaw was found in the way WavPack handled processing of CAF (Core Audio Format) files. An attacker could potentially use this flaw to crash WavPack by tricking it into processing crafted CAF files.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-10-05 22:02:29 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Pedro Sampaio 2018-02-21 15:23:22 EST

The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows an attacker to cause a denial-of-service due to global buffer over-read via a maliciously crafted CAF file.

Upstream bug:

https://github.com/dbry/WavPack/issues/26

Upstream patch:

https://github.com/dbry/WavPack/commit/8e3fe45a7bac31d9a3b558ae0079e2d92a04799e

Comment 1 Pedro Sampaio 2018-02-21 15:24:00 EST

Created mingw-wavpack tracking bugs for this issue:

Affects: epel-7 [bug 1547737]
Affects: fedora-all [bug 1547736]


Created wavpack tracking bugs for this issue:

Affects: fedora-all [bug 1547738]

Comment 4 Sergio Monteiro Basto 2018-10-05 22:02:29 EDT

https://src.fedoraproject.org/rpms/wavpack/c/be8d9f333fca9df19894a907d33aded11cb16cbc?branch=master

Note You need to log in before you can comment on or make changes to this bug.