CVE-2018-10538
Publication date 29 April 2018
Last updated 25 August 2025
Ubuntu priority
Description
An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| wavpack | 18.04 LTS bionic |
Fixed 5.1.0-2ubuntu1.1
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty | Not in release |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.5 · Medium
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-3637-1
- WavPack vulnerabilities
- 30 April 2018