svn commit: r469776 - head/security/vuxml

Sun May 13 07:21:28 UTC 2018

Author: riggs
Date: Sun May 13 07:21:26 2018
New Revision: 469776
URL: https://svnweb.freebsd.org/changeset/ports/469776

Log:
  Document vulnerabilities in wavpack 5.1.0 and earlier
  
  PR:		228146
  Submitted by:	yasu at utahime.org

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Sun May 13 06:16:49 2018	(r469775)
+++ head/security/vuxml/vuln.xml	Sun May 13 07:21:26 2018	(r469776)
@@ -58,6 +58,63 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="50210bc1-54ef-11e8-95d9-9c5c8e75236a">
+    <topic>wavpack -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>wavpack</name>
+	<range><lt>5.1.0_1</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Sebastian Ramacher reports:</p>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767">
+	  <p>A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.</p>
+	</blockquote>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253">
+	  <p>The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.</p>
+	</blockquote>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254">
+	  <p>The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.</p>
+	</blockquote>
+	<p>Thuan Pham reports:</p>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536">
+	  <p>An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.</p>
+	</blockquote>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537">
+	  <p>An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.</p>
+	</blockquote>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538">
+	  <p>An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
+	</blockquote>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539">
+	  <p>An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
+	</blockquote>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540">
+	  <p>An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2018-6767</cvename>
+      <cvename>CVE-2018-7253</cvename>
+      <cvename>CVE-2018-7254</cvename>
+      <cvename>CVE-2018-10536</cvename>
+      <cvename>CVE-2018-10537</cvename>
+      <cvename>CVE-2018-10538</cvename>
+      <cvename>CVE-2018-10539</cvename>
+      <cvename>CVE-2018-10540</cvename>
+      <url>https://www.debian.org/security/2018/dsa-4125</url>
+      <url>https://www.debian.org/security/2018/dsa-4197</url>
+      <freebsdpr>228141</freebsdpr>
+    </references>
+    <dates>
+      <discovery>2018-05-09</discovery>
+      <entry>2018-05-11</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="e457978b-5484-11e8-9b85-54ee754af08e">
     <topic>chromium -- multiple vulnerabilities</topic>
     <affects>
