Security update for wavpack SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0772-1 Final 1 1 2019-03-27T09:37:18Z current 2019-03-27T09:37:18Z 2019-03-27T09:37:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for wavpack This update for wavpack fixes the following issues: Security issues fixed: - CVE-2018-19840: Fixed a denial-of-service in the WavpackPackInit function from pack_utils.c (bsc#1120930) - CVE-2018-19841: Fixed a denial-of-service in the WavpackVerifySingleBlock function from open_utils.c (bsc#1120929) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP1-SAPCAL-Azure-2019-772,Image SLES15-SP1-SAPCAL-EC2-HVM-2019-772,Image SLES15-SP1-SAPCAL-GCE-2019-772,Image SLES15-SP3-EC2-HVM-2019-772,Image SLES15-SP3-SAP-Azure-2019-772,Image SLES15-SP3-SAP-EC2-HVM-2019-772,Image SLES15-SP3-SAP-GCE-2019-772,Image SLES15-SP3-SAPCAL-Azure-2019-772,Image SLES15-SP3-SAPCAL-EC2-HVM-2019-772,Image SLES15-SP3-SAPCAL-GCE-2019-772,Image SLES15-SP4-SAP-2019-772,Image SLES15-SP4-SAP-Azure-2019-772,Image SLES15-SP4-SAP-EC2-2019-772,Image SLES15-SP4-SAP-GCE-2019-772,Image SLES15-SP4-SAPCAL-2019-772,Image SLES15-SP4-SAPCAL-Azure-2019-772,Image SLES15-SP4-SAPCAL-EC2-2019-772,Image SLES15-SP4-SAPCAL-GCE-2019-772,Image SLES15-SP5-SAP-Azure-2019-772,Image SLES15-SP5-SAP-EC2-2019-772,Image SLES15-SP5-SAP-GCE-2019-772,Image SLES15-SP5-SAPCAL-Azure-2019-772,Image SLES15-SP5-SAPCAL-EC2-2019-772,Image SLES15-SP5-SAPCAL-GCE-2019-772,SUSE-2019-772,SUSE-SLE-Module-Basesystem-15-2019-772,SUSE-SLE-Module-Desktop-Applications-15-2019-772 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190772-1/ Link for SUSE-SU-2019:0772-1 https://lists.suse.com/pipermail/sle-security-updates/2019-March/005253.html E-Mail link for SUSE-SU-2019:0772-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1120929 SUSE Bug 1120929 https://bugzilla.suse.com/1120930 SUSE Bug 1120930 https://www.suse.com/security/cve/CVE-2018-19840/ SUSE CVE CVE-2018-19840 page https://www.suse.com/security/cve/CVE-2018-19841/ SUSE CVE CVE-2018-19841 page Image SLES15-SP1-SAPCAL-Azure Image SLES15-SP1-SAPCAL-EC2-HVM Image SLES15-SP1-SAPCAL-GCE Image SLES15-SP3-EC2-HVM Image SLES15-SP3-SAP-Azure Image SLES15-SP3-SAP-EC2-HVM Image SLES15-SP3-SAP-GCE Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-EC2-HVM Image SLES15-SP3-SAPCAL-GCE Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Image SLES15-SP5-SAP-Azure Image SLES15-SP5-SAP-EC2 Image SLES15-SP5-SAP-GCE Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Desktop Applications 15 libwavpack1-5.1.0-4.3.5 libwavpack1-32bit-5.1.0-4.3.5 libwavpack1-64bit-5.1.0-4.3.5 wavpack-5.1.0-4.3.5 wavpack-devel-5.1.0-4.3.5 libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP1-SAPCAL-Azure libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP1-SAPCAL-GCE libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP3-EC2-HVM libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP3-SAP-Azure libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP3-SAP-EC2-HVM libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP3-SAP-GCE libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP3-SAPCAL-Azure libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP3-SAPCAL-GCE libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP4-SAP libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP4-SAP-Azure libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP4-SAP-EC2 libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP4-SAP-GCE libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP4-SAPCAL libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP4-SAPCAL-Azure libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP4-SAPCAL-EC2 libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP4-SAPCAL-GCE libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP5-SAP-Azure libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP5-SAP-EC2 libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP5-SAP-GCE libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP5-SAPCAL-Azure libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP5-SAPCAL-EC2 libwavpack1-5.1.0-4.3.5 as a component of Image SLES15-SP5-SAPCAL-GCE libwavpack1-5.1.0-4.3.5 as a component of SUSE Linux Enterprise Module for Basesystem 15 wavpack-5.1.0-4.3.5 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 wavpack-devel-5.1.0-4.3.5 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero. CVE-2018-19840 Image SLES15-SP1-SAPCAL-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP1-SAPCAL-EC2-HVM:libwavpack1-5.1.0-4.3.5 Image SLES15-SP1-SAPCAL-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-EC2-HVM:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAP-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAP-EC2-HVM:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAP-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAPCAL-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAPCAL-EC2-HVM:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAPCAL-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAP-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAP-EC2:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAP-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAP:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAPCAL-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAPCAL-EC2:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAPCAL-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAPCAL:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAP-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAP-EC2:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAP-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAPCAL-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAPCAL-EC2:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAPCAL-GCE:libwavpack1-5.1.0-4.3.5 SUSE Linux Enterprise Module for Basesystem 15:libwavpack1-5.1.0-4.3.5 SUSE Linux Enterprise Module for Desktop Applications 15:wavpack-5.1.0-4.3.5 SUSE Linux Enterprise Module for Desktop Applications 15:wavpack-devel-5.1.0-4.3.5 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190772-1/ https://www.suse.com/security/cve/CVE-2018-19840.html CVE-2018-19840 https://bugzilla.suse.com/1120930 SUSE Bug 1120930 The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack. CVE-2018-19841 Image SLES15-SP1-SAPCAL-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP1-SAPCAL-EC2-HVM:libwavpack1-5.1.0-4.3.5 Image SLES15-SP1-SAPCAL-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-EC2-HVM:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAP-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAP-EC2-HVM:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAP-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAPCAL-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAPCAL-EC2-HVM:libwavpack1-5.1.0-4.3.5 Image SLES15-SP3-SAPCAL-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAP-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAP-EC2:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAP-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAP:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAPCAL-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAPCAL-EC2:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAPCAL-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP4-SAPCAL:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAP-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAP-EC2:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAP-GCE:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAPCAL-Azure:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAPCAL-EC2:libwavpack1-5.1.0-4.3.5 Image SLES15-SP5-SAPCAL-GCE:libwavpack1-5.1.0-4.3.5 SUSE Linux Enterprise Module for Basesystem 15:libwavpack1-5.1.0-4.3.5 SUSE Linux Enterprise Module for Desktop Applications 15:wavpack-5.1.0-4.3.5 SUSE Linux Enterprise Module for Desktop Applications 15:wavpack-devel-5.1.0-4.3.5 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190772-1/ https://www.suse.com/security/cve/CVE-2018-19841.html CVE-2018-19841 https://bugzilla.suse.com/1120929 SUSE Bug 1120929