{"id":"SUSE-SU-2021:0186-1","summary":"Security update for wavpack","details":"This update for wavpack fixes the following issues:\n\n- Update to version 5.4.0\n  * CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414) \n  * fixed: disable A32 asm code when building for Apple silicon\n  * fixed: issues with Adobe-style floating-point WAV files\n  * added: --normalize-floats option to wvunpack for correctly\n             exporting un-normalized floating-point files\n- Update to version 5.3.0 \n  * fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448\n  * fixed: trailing garbage characters on imported ID3v2 TXXX tags\n  * fixed: various minor undefined behavior and memory access issues\n  * fixed: sanitize tag extraction names for length and path inclusion\n  * improved: reformat wvunpack 'help' and split into long + short versions\n  * added: regression testing to Travis CI for OSS-Fuzz crashers\n- Updated to version 5.2.0 \n  *fixed: potential security issues including the following CVEs:\n         CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344),\n         CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342),  \n         CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), \n         CVE-2018-7254,  CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 \n         and CVE-2019-1010319\n  * added: support for CMake, Travis CI, and Google's OSS-fuzz\n  * fixed: use correction file for encode verify (pipe input, Windows)\n  * fixed: correct WAV header with actual length (pipe input, -i option)\n  * fixed: thumb interworking and not needing v6 architecture (ARM asm)\n  * added: handle more ID3v2.3 tag items and from all file types\n  * fixed: coredump on Sparc64 (changed MD5 implementation)\n  * fixed: handle invalid ID3v2.3 tags from sacd-ripper\n  * fixed: several corner-case memory leaks\n","modified":"2026-02-04T03:57:29.344033Z","published":"2021-01-21T13:56:16Z","related":["CVE-2018-10536","CVE-2018-10537","CVE-2018-10538","CVE-2018-10539","CVE-2018-10540","CVE-2018-19840","CVE-2018-19841","CVE-2018-6767","CVE-2018-7253","CVE-2018-7254","CVE-2019-1010319","CVE-2019-11498","CVE-2020-35738"],"upstream":["CVE-2018-10536","CVE-2018-10537","CVE-2018-10538","CVE-2018-10539","CVE-2018-10540","CVE-2018-19840","CVE-2018-19841","CVE-2018-6767","CVE-2018-7253","CVE-2018-7254","CVE-2019-1010319","CVE-2019-11498","CVE-2020-35738"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210186-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1091340"},{"type":"REPORT","url":"https://bugzilla.suse.com/1091341"},{"type":"REPORT","url":"https://bugzilla.suse.com/1091342"},{"type":"REPORT","url":"https://bugzilla.suse.com/1091343"},{"type":"REPORT","url":"https://bugzilla.suse.com/1091344"},{"type":"REPORT","url":"https://bugzilla.suse.com/1180414"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10536"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10537"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10538"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10539"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10540"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-19840"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-19841"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-6767"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-7253"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-7254"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-1010319"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-11498"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-35738"}],"affected":[{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"wavpack":"5.4.0-4.9.1","wavpack-devel":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"wavpack-devel":"5.4.0-4.9.1","wavpack":"5.4.0-4.9.1","libwavpack1":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1","wavpack-devel":"5.4.0-4.9.1","wavpack":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1","wavpack-devel":"5.4.0-4.9.1","wavpack":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1","wavpack-devel":"5.4.0-4.9.1","wavpack":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"wavpack":"5.4.0-4.9.1","libwavpack1":"5.4.0-4.9.1","wavpack-devel":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Manager Proxy 4.0","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Manager%20Proxy%204.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1","wavpack-devel":"5.4.0-4.9.1","wavpack":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Manager Retail Branch Server 4.0","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1","wavpack-devel":"5.4.0-4.9.1","wavpack":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Manager Server 4.0","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Manager%20Server%204.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"wavpack-devel":"5.4.0-4.9.1","wavpack":"5.4.0-4.9.1","libwavpack1":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}},{"package":{"name":"wavpack","ecosystem":"SUSE:Enterprise Storage 6","purl":"pkg:rpm/suse/wavpack&distro=SUSE%20Enterprise%20Storage%206"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.9.1"}]}],"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-4.9.1","wavpack-devel":"5.4.0-4.9.1","wavpack":"5.4.0-4.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:0186-1.json"}}],"schema_version":"1.7.3"}