SB2018030632 - Memory corruption in wavpack (Alpine package)
Published: March 6, 2018
Security Bulletin ID
SB2018030632
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Memory corruption (CVE-ID: CVE-2018-7254)
The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.The weakness exists in the cli/caff.c source codein the ParseCaffHeaderConfig function due to boundary error. A remote attacker can submit a specially crafted CAF file, trigger a buffer overflow or incorrect memory allocation and cause the service to crash.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=fcfac0bb84e91ad39d8554e3ff04d2aacc625915
- https://git.alpinelinux.org/aports/commit/?id=ac2fd8a89cfc84daba107884f80429f966353415
- https://git.alpinelinux.org/aports/commit/?id=e5938228bdfcb80390ff361b79966fdcf0fdb35a
- https://git.alpinelinux.org/aports/commit/?id=f06887bf6720ff8c26e5a7e3b87488cb2be83be2
- https://git.alpinelinux.org/aports/commit/?id=2ec57e0e13ceccd61a0be8376969fb676d94c14a
- https://git.alpinelinux.org/aports/commit/?id=6f7ce22e0374f4f07d4f220f22ad7be8de37f4ac
- https://git.alpinelinux.org/aports/commit/?id=9dfd25362f073d372045e0b2f575b99adca85ce3
- https://git.alpinelinux.org/aports/commit/?id=f33256418323bfc32d596c316881a3f72f885045
- https://git.alpinelinux.org/aports/commit/?id=fb7b00ff6a263a7328d8ef29ef262efdd3979420