CVE-2019-1010319 Null dereference in WavPack

Medium 5.5 Published 11 Jul 2019 Updated 5 Aug 2024

Attackers can cause crashes and unexpected control flow in WavPack by providing a maliciously crafted .wav file due to uninitialized variable usage.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-1010319?

CVE-2019-1010319 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 11 Jul 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.

Weakness: CWE-908, CWE-457

Which versions are affected by CVE-2019-1010319?

It affects 4 products.

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Wavpack Wavpack.

How do I fix CVE-2019-1010319?

Apply the vendor's patch.

Is CVE-2019-1010319 being exploited?

There is no known exploitation of CVE-2019-1010319 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-1010319, DEBIAN-CVE-2019-1010319, GHSA-m7x8-vqr5-hrmv, UBUNTU-CVE-2019-1010319.