Risk | Low |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2019-1010319 CVE-2019-11498 |
CWE-ID | CWE-665 CWE-20 |
Exploitation vector | Network |
Public exploit |
Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. |
Vulnerable software Subscribe |
Opensuse Operating systems & Components / Operating system |
Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU19215
Risk: Low
CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C]
CVE-ID: CVE-2019-1010319
CWE-ID:
CWE-665 - Improper Initialization
Exploit availability: No
DescriptionUpdate the affected packages.
Opensuse: 15.0 - 15.1
External linkshttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00015.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU19226
Risk: Low
CVSSv3.1: 5.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C]
CVE-ID: CVE-2019-11498
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the WavpackSetConfiguration64() function in the pack_utils.c file within the libwavpack.a. A remote attacker can trick the victim to open a specially crafted DFF file that lacks valid sample-rate data and crash the affected application.
MitigationUpdate the affected packages.
Opensuse: 15.0 - 15.1
External linkshttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00015.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.