TI-2019-16078 Aliases CVE-2019-1010319 GHSA-m7x8-vqr5-hrmv

Use of uninitialized resource in WavPack

LOW 28CWE-457Published 2019-07-11 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-457 and the CVSS impact.

Summary

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.

Why it matters now

EPSS 0.01516 74th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WavPack	WavPack	<=5.1.0 [fixed: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe]	—	No fix listed	CNA

WavPack VendorWavPack Affected <=5.1.0 [fixed: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe] Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPE	Versions	Role	Vendor
cpe:2.3:a:wavpack:wavpack::::::::	up to 5.1.0	Vulnerable	WavPack
cpe:2.3:o:fedoraproject:fedora:29:::::::*	29	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:30:::::::*	30	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:31:::::::*	31	Vulnerable	Fedoraproject
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::	18.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*	19.04	Vulnerable	Canonical
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian

cpe:2.3:a:wavpack:wavpack:*:*:*:*:*:*:*:* Versions up to 5.1.0 Vulnerable ·WavPack
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

Red Hat 1 advisory

RHSA-2020:1581 Released 2020-04-28 · Red Hat rating Low
wavpack security update
- Red Hat CodeReady Linux Builder (v. 8) wavpack-devel-5.1.0-15.el8
- Red Hat Enterprise Linux AppStream (v. 8) wavpack-5.1.0-15.el8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2019-07-11
WavPack — USN-4062-1
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2019-16077 Use of uninitialized resource in WavPackPriority LOW 28
- TI-2019-16075 WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero.Priority LOW 28
Show all 3 records → Advisory →
Advisory · 2019-07-11
WavPack — FEDORA-2019-8eeb8f9d3f
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2019-16077 Use of uninitialized resource in WavPackPriority LOW 28
Show all 2 records → Advisory →

Show 1 more group

Advisory · 2019-07-11
WavPack — FEDORA-2019-c72f5f6361
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2019-16077 Use of uninitialized resource in WavPackPriority LOW 28
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat CodeReady Linux Builder (v. 8)	Fixed	RHSA-2020:1581
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2020:1581

Not affected: 2 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7

Timeline

2026-10-02 Threatist record created from CVE-2019-1010319
2026-10-03 Alias added: GHSA-m7x8-vqr5-hrmv

References

Exploit 1

https://github.com/dbry/WavPack/issues/68

Patch 1

https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe

Advisory 6

TI-2018-05262 The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a… CVSS 3.0HIGH 7.8
TI-2018-05261 The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a… CVSS 3.0HIGH 7.8
TI-2018-04943 A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file… CVSS 3.0HIGH 7.8
TI-2018-07441 An issue was discovered in WavPack 5.1.0 and earlier. CVSS 3.0HIGH 7.8
TI-2018-07440 An issue was discovered in WavPack 5.1.0 and earlier. CVSS 3.0HIGH 7.8
TI-2019-08589 WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a… CVSS 3.1MEDIUM 6.5

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences