CVE-2018-19840
MEDIUM
5,5
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
MEDIUM
4,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: none
Integrity: none
Availability: partial
Description
AI Translation Available
The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0035
Percentile
0,6th
Updated
EPSS Score Trend (Last 90 Days)
835
Loop with Unreachable Exit Condition ('Infinite Loop')
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Amplification
Applicable Platforms
All platforms may be affected
Operating System
Ubuntu Linux by Canonical
CPE Identifier
View Detailed Analysis
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Ubuntu Linux by Canonical
CPE Identifier
View Detailed Analysis
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Fedora by Fedoraproject
CPE Identifier
View Detailed Analysis
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Wavpack by Wavpack
Version Range Affected
To
5.1.0
(inclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:wavpack:wavpack:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Ubuntu Linux by Canonical
CPE Identifier
View Detailed Analysis
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Fedora by Fedoraproject
CPE Identifier
View Detailed Analysis
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Fedora by Fedoraproject
CPE Identifier
View Detailed Analysis
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Leap by Opensuse
CPE Identifier
View Detailed Analysis
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Ubuntu Linux by Canonical
CPE Identifier
View Detailed Analysis
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00029.html
http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack…
https://github.com/dbry/WavPack/commit/070ef6f138956d9ea9612e69586152339dbefe51
https://github.com/dbry/WavPack/issues/53
https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://seclists.org/bugtraq/2019/Dec/37
https://security.gentoo.org/glsa/202007-19
https://usn.ubuntu.com/3839-1/
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00029.html
http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack…
https://github.com/dbry/WavPack/commit/070ef6f138956d9ea9612e69586152339dbefe51
https://github.com/dbry/WavPack/issues/53
https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://seclists.org/bugtraq/2019/Dec/37
https://security.gentoo.org/glsa/202007-19
https://usn.ubuntu.com/3839-1/