Multiple vulnerabilities have been found in WavPack, the worst of which could result in a Denial of Service condition.

Announced

2020-07-27

Revised

2020-07-27

Access

remote

Bugs

#672638

Advisory

https://security.gentoo.org/glsa/202007-19

Affected packages

Package	Arch	Vulnerable	Unaffected
media-sound/wavpack	*	< 5.3.2	>= 5.3.2

Background

WavPack is a set of hybrid lossless audio compression tools.

Description

Multiple vulnerabilities have been discovered in WavPack. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could send a specially crafted audio file possibly resulting in a Denial of Service condition. Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All WavPack users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-sound/wavpack-5.3.2"

References

• CVE-2018-19840
• CVE-2018-19841
• CVE-2019-11498