CVE:CVE-2018-6767
CNNVD:CNNVD-201802-149
WavPack是一套开源的、免费的音频无损压缩软件。
WavPack 5.1.0版本中的cli/riff.c文件的‘ParseRiffHeaderConfig’函数存在越边界读取漏洞。远程攻击者可借助恶意制作的RF64文件利用该漏洞造成拒绝服务。
solution:Upgrade wavpack wavpack to a higher version than 5.1.0,and avoid the version 5.1.0; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade canonical ubuntu_linux to a higher version than 14.04,16.04,17.10,and avoid the version 14.04,16.04,17.10