CVE-2018-7254

moderate-risk
Published 2018-02-19

The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.

Do I need to act?

!
21.3% chance of exploitation in next 30 days
EPSS score — higher than 79% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
44154
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (2)

Wavpack

Affected Vendors

Debian Wavpack

References (16)

http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-...
Issue Tracking https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889274
Patch https://github.com/dbry/WavPack/commit/8e3fe45a7bac31d9a3b558ae0079e2d92a04799e
Issue Tracking https://github.com/dbry/WavPack/issues/26
https://seclists.org/bugtraq/2019/Dec/37
Third Party Advisory https://usn.ubuntu.com/3578-1/
Third Party Advisory https://www.debian.org/security/2018/dsa-4125
Third Party Advisory https://www.exploit-db.com/exploits/44154/
http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-...
Issue Tracking https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889274
Patch https://github.com/dbry/WavPack/commit/8e3fe45a7bac31d9a3b558ae0079e2d92a04799e
Issue Tracking https://github.com/dbry/WavPack/issues/26
https://seclists.org/bugtraq/2019/Dec/37
Third Party Advisory https://usn.ubuntu.com/3578-1/
Third Party Advisory https://www.debian.org/security/2018/dsa-4125
Third Party Advisory https://www.exploit-db.com/exploits/44154/
45
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 14/34 · Moderate
Exposure 7/34 · Low