CVE-2019-1010317 Memory corruption in WavPack

Medium 5.5 Published 11 Jul 2019 Updated 5 Aug 2024

Attackers can cause crashes and unexpected control flow in WavPack by providing a maliciously crafted .wav file due to uninitialized variable usage.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-1010317?

CVE-2019-1010317 is a medium-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 11 Jul 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.

Weakness: CWE-908, CWE-457

Which versions are affected by CVE-2019-1010317?

It affects 4 products.

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Wavpack Wavpack.

How do I fix CVE-2019-1010317?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-1010317 being exploited?

There is no known exploitation of CVE-2019-1010317 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-1010317, DEBIAN-CVE-2019-1010317, GHSA-7wf6-38w5-gjg5, UBUNTU-CVE-2019-1010317.