SB2018030630 - Stack-based buffer over-read in wavpack (Alpine package)
Published: March 6, 2018
Security Bulletin ID
SB2018030630
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Stack-based buffer over-read (CVE-ID: CVE-2018-6767)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to a stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file. A remote attacker can send a specially crafted RF64 file cause the application to crash.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=fcfac0bb84e91ad39d8554e3ff04d2aacc625915
- https://git.alpinelinux.org/aports/commit/?id=a72e9dec2ca905acb1090eae42c239c177a553f0
- https://git.alpinelinux.org/aports/commit/?id=ac2fd8a89cfc84daba107884f80429f966353415
- https://git.alpinelinux.org/aports/commit/?id=cf8d2a4da0a509445e4b9e7eda5074c70fad88c6
- https://git.alpinelinux.org/aports/commit/?id=2ec57e0e13ceccd61a0be8376969fb676d94c14a
- https://git.alpinelinux.org/aports/commit/?id=6f7ce22e0374f4f07d4f220f22ad7be8de37f4ac
- https://git.alpinelinux.org/aports/commit/?id=9dfd25362f073d372045e0b2f575b99adca85ce3
- https://git.alpinelinux.org/aports/commit/?id=f33256418323bfc32d596c316881a3f72f885045
- https://git.alpinelinux.org/aports/commit/?id=fb7b00ff6a263a7328d8ef29ef262efdd3979420