CVE-2019-1010317

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.

References

Affected packages

Git / github.com/dbry/wavpack

Affected ranges

Type: GIT
Repo: https://github.com/dbry/wavpack
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

f68a9555b548306c5b1ee45199ccdc4a16a6101b

Affected versions

4.*

4.70.0

4.70.0-rc

4.75.0

4.75.0-rc

4.75.2

4.80.0

4.80.0-rc

5.*

5.0.0

5.0.0-alpha

5.0.0-alpha2

5.0.0-alpha3

5.0.0-alpha4

5.0.0-alpha5

5.1.0

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/dbry/wavpack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b",
        "target": {
            "function": "ParseCaffHeaderConfig",
            "file": "cli/caff.c"
        },
        "deprecated": false,
        "id": "CVE-2019-1010317-2deade7e",
        "signature_version": "v1",
        "digest": {
            "length": 11022.0,
            "function_hash": "80991656525026975324078027612999430066"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://github.com/dbry/wavpack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b",
        "target": {
            "file": "cli/caff.c"
        },
        "deprecated": false,
        "id": "CVE-2019-1010317-3f06a6ab",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "207282036086540382901223437960274206226",
                "295277005122744263621529808549708633693",
                "337671784419228819593293206671993219193",
                "168076874139691416387418067897600433450",
                "242159319118789201639797942065816862095",
                "183039602759297547670920798511018539299",
                "101052414796787229135530354972511976988",
                "278336399402704226067780038366185926937",
                "100407542647608178177346719891605124341",
                "165743405433883728473423841452480822066",
                "331630113680726530398711294304434144857",
                "211962050958395306744747486734170649564"
            ]
        },
        "signature_type": "Line"
    }
]