ALSA-2020:1581

Dashboard / Vulnerabilities / ALSA-2020:1581

ALSA-2020:1581

Summary: Low: wavpack security update

Details: WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. Security Fix(es): * wawpack: Infinite loop in WavpackPackInit function lead to DoS (CVE-2018-19840) * wawpack: Out-of-bounds read in WavpackVerifySingleBlock function leads to DoS (CVE-2018-19841) * wavpack: Use of uninitialized variable in WavpackSetConfiguration64 leads to DoS (CVE-2019-11498) * wavpack: Divide by zero in ParseDsdiffHeaderConfig leads to crash (CVE-2019-1010315) * wavpack: Use of uninitialized variable in ParseCaffHeaderConfig leads to DoS (CVE-2019-1010317) * wavpack: Use of uninitialized variable in ParseWave64HeaderConfig leads to DoS (CVE-2019-1010319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References: https://errata.almalinux.org/8/ALSA-2020-1581.html, https://vulners.com/cve/CVE-2018-19840, https://vulners.com/cve/CVE-2018-19841, https://vulners.com/cve/CVE-2019-1010315, https://vulners.com/cve/CVE-2019-1010317, https://vulners.com/cve/CVE-2019-1010319, https://vulners.com/cve/CVE-2019-11498