WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.
The product uses or accesses a resource that has not been initialized.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wavpack | Wavpack | * | 5.1.0 (including) |
| Red Hat Enterprise Linux 8 | RedHat | wavpack-0:5.1.0-15.el8 | * |
| Wavpack | Ubuntu | bionic | * |
| Wavpack | Ubuntu | cosmic | * |
| Wavpack | Ubuntu | disco | * |
| Wavpack | Ubuntu | trusty | * |
| Wavpack | Ubuntu | upstream | * |