Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

Vulnerability Intelligence

Customers

Vulnerability IntelligenceCVE-2018-10536

CVE-2018-10536

HIGH7.8

An issue was discovered in WavPack 5

Published Apr 29, 2018

Modified 1 years ago

Details

An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.

References

WEB

http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html

WEB

https://github.com/dbry/WavPack/commit/26cb47f99d481ad9b93eeff80d26e6b63bbd7e15

WEB

https://github.com/dbry/WavPack/issues/30

WEB

https://github.com/dbry/WavPack/issues/31

WEB

https://github.com/dbry/WavPack/issues/32

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA/

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/

WEB

https://seclists.org/bugtraq/2019/Dec/37

ADVISORY

https://usn.ubuntu.com/3637-1/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2018-10536

ADVISORY

https://www.debian.org/security/2018/dsa-4197

CVSS Analysis

CVSS v3.0

7.8

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

7.8/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Ecosystems

Timeline

PublishedApr 29, 2018

ModifiedAug 5, 2024

CVE-2018-10536 | Mondoo Vulnerability Intelligence