Arch Linux update for wavpack
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2018-6767 CVE-2018-7253 CVE-2018-7254 |
| CWE-ID | CWE-119 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #3 is available. |
| Vulnerable software Subscribe |
Arch Linux Operating systems & Components / Operating system |
| Vendor | Arch Linux |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Stack-based buffer over-read
EUVDB-ID: #VU10573
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-6767
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to a stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file. A remote attacker can send a specially crafted RF64 file cause the application to crash.
Update the affected package wavpack to version 5.1.0-2.
Vulnerable software versionsArch Linux: All versions
CPE2.3 External linkshttp://security.archlinux.org/advisory/ASA-201802-14
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Memory corruption
EUVDB-ID: #VU10823
Risk: Low
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-7253
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote unautheticated attacker to cause DoS condition on the target system.
The weakness exists in the cli/dsdiff.c source codein the ParseDsdiffHeaderConfig function due to boundary error. A remote attacker can send a specially crafted DSDIFF file, trigger memory corruption and cause the service to crash.
Update the affected package wavpack to version 5.1.0-2.
Vulnerable software versionsArch Linux: All versions
CPE2.3 External linkshttp://security.archlinux.org/advisory/ASA-201802-14
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Memory corruption
EUVDB-ID: #VU10822
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2018-7254
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: Yes
DescriptionThe vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.
The weakness exists in the cli/caff.c source codein the ParseCaffHeaderConfig function due to boundary error. A remote attacker can submit a specially crafted CAF file, trigger a buffer overflow or incorrect memory allocation and cause the service to crash.
Update the affected package wavpack to version 5.1.0-2.
Vulnerable software versionsArch Linux: All versions
CPE2.3 External linkshttp://security.archlinux.org/advisory/ASA-201802-14
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
