WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.
The product uses or accesses a resource that has not been initialized.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wavpack | Wavpack | * | 5.1.0 (including) |
| Red Hat Enterprise Linux 8 | RedHat | wavpack-0:5.1.0-15.el8 | * |
| Wavpack | Ubuntu | bionic | * |
| Wavpack | Ubuntu | cosmic | * |
| Wavpack | Ubuntu | disco | * |
| Wavpack | Ubuntu | trusty | * |
| Wavpack | Ubuntu | upstream | * |