USN-3568-1: WavPack vulnerabilities

Releases

• Ubuntu 17.10
• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• wavpack - audio codec (lossy and lossless) - encoder and decoder

Details

Hanno Böck discovered that WavPack incorrectly handled certain
WV files. An attacker could possibly use this to cause a denial
of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu
16.04 LTS. (CVE-2016-10169)

Joonun Jang discovered that WavPack incorrectly handled certain
RF64 files. An attacker could possibly use this to cause a denial
of service. This issue only affected Ubuntu 17.10. (CVE-2018-6767)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10

• libwavpack1 - 5.1.0-2ubuntu0.1
• wavpack - 5.1.0-2ubuntu0.1

Ubuntu 16.04

• libwavpack1 - 4.75.2-2ubuntu0.1
• wavpack - 4.75.2-2ubuntu0.1

Ubuntu 14.04

• libwavpack1 - 4.70.0-1ubuntu0.1
• wavpack - 4.70.0-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2016-10169
• CVE-2018-6767