diff options
| author | Thomas Zander <riggs@FreeBSD.org> | 2018-05-13 15:21:26 +0800 |
|---|---|---|
| committer | Thomas Zander <riggs@FreeBSD.org> | 2018-05-13 15:21:26 +0800 |
| commit | 967a20ac1c1cf36785cfc4b97f4c902bd7e46a34 (patch) | |
| tree | 44611347c73f4c745b4491e12e0a050a6a317b78 /security | |
| parent | 420e9032a1dcb48fec0b324d73b9900495283ea5 (diff) | |
| download | freebsd-ports-gnome-967a20ac1c1cf36785cfc4b97f4c902bd7e46a34.tar.gz freebsd-ports-gnome-967a20ac1c1cf36785cfc4b97f4c902bd7e46a34.tar.zst freebsd-ports-gnome-967a20ac1c1cf36785cfc4b97f4c902bd7e46a34.zip | |
Document vulnerabilities in wavpack 5.1.0 and earlier
PR: 228146
Submitted by: yasu@utahime.org
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index c638b95a6c1c..56afd4ab1836 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,63 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="50210bc1-54ef-11e8-95d9-9c5c8e75236a"> + <topic>wavpack -- multiple vulnerabilities</topic> + <affects> + <package> + <name>wavpack</name> + <range><lt>5.1.0_1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Sebastian Ramacher reports:</p> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767"> + <p>A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.</p> + </blockquote> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253"> + <p>The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.</p> + </blockquote> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254"> + <p>The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.</p> + </blockquote> + <p>Thuan Pham reports:</p> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536"> + <p>An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.</p> + </blockquote> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537"> + <p>An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.</p> + </blockquote> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538"> + <p>An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p> + </blockquote> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539"> + <p>An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p> + </blockquote> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540"> + <p>An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2018-6767</cvename> + <cvename>CVE-2018-7253</cvename> + <cvename>CVE-2018-7254</cvename> + <cvename>CVE-2018-10536</cvename> + <cvename>CVE-2018-10537</cvename> + <cvename>CVE-2018-10538</cvename> + <cvename>CVE-2018-10539</cvename> + <cvename>CVE-2018-10540</cvename> + <url>https://www.debian.org/security/2018/dsa-4125</url> + <url>https://www.debian.org/security/2018/dsa-4197</url> + <freebsdpr>228141</freebsdpr> + </references> + <dates> + <discovery>2018-05-09</discovery> + <entry>2018-05-11</entry> + </dates> + </vuln> + <vuln vid="e457978b-5484-11e8-9b85-54ee754af08e"> <topic>chromium -- multiple vulnerabilities</topic> <affects> |