SB2017020110 - Fedora 24 update for wavpack
Published: February 1, 2017 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2016-10169)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to the read_code function in read_words.c. A remote attacker can supply a specially crafted WV file, trigger out-of-bounds read and cause the application to crash.
2) Out-of-bounds read (CVE-ID: CVE-2016-10170)
The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.
The WriteCaffHeader function in cli/caff.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
3) Out-of-bounds read (CVE-ID: CVE-2016-10171)
The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
4) Out-of-bounds read (CVE-ID: CVE-2016-10172)
The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Remediation
Install update from vendor's website.