WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wavpack | Wavpack | * | 5.1.0 (including) |
| Red Hat Enterprise Linux 8 | RedHat | wavpack-0:5.1.0-15.el8 | * |
| Wavpack | Ubuntu | bionic | * |
| Wavpack | Ubuntu | cosmic | * |
| Wavpack | Ubuntu | disco | * |
| Wavpack | Ubuntu | esm-infra/bionic | * |
| Wavpack | Ubuntu | trusty | * |
| Wavpack | Ubuntu | upstream | * |