SB2019071705 - Ubuntu update for WavPack

Security Bulletin ID SB2019071705

Severity

Medium

Patch available

YES

Number of vulnerabilities 3

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Division by zero (CVE-ID: CVE-2019-1010315)

The vulnerability allows a remote attacker to cause a denial of service (DoS) condition on a targeted system.

The vulnerability exists due to a divide by zero error in the "ParseDsdiffHeaderConfig()" function in the "dsdiff.c" file, when parsing .wav files.

A remote attacker can trick a victim to open a specially crafted .wav file and crash the affected application.

2) Improper Initialization (CVE-ID: CVE-2019-1010317)

The vulnerability allows a remote attacker to cause a denial of service (DoS) condition on a targeted system.

The vulnerability exists due to an uninitialized read condition in the "ParseCaffHeaderConfig()" function in the caff.c file when parsing .wav files. A remote attacker can persuade a user to access a .wav file that submits malicious input to the targeted system and perform a DoS attack.

3) Improper Initialization (CVE-ID: CVE-2019-1010319)

The vulnerability allows a remote attacker to cause a denial of service (DoS) condition on the targeted system.

The vulnerability exists due to an uninitialized read condition in the "ParseWave64HeaderConfig()" function in "wave64.c" file when parsing .wav files. A remote attacker can trick a victim to open a specially crafted .wav file and crash the affected application.

Remediation

Install update from vendor's website.

References

https://usn.ubuntu.com/4062-1/