CVE-2019-11498

Name	CVE-2019-11498
Description	WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-2525-1
Debian Bugs	927903

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wavpack (PTS)	buster	5.1.0-6+deb10u1	fixed
	bullseye	5.4.0-1	fixed
	bookworm, sid	5.6.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
wavpack	source	jessie	(not affected)
wavpack	source	stretch	5.0.0-2+deb9u3		DLA-2525-1
wavpack	source	(unstable)	5.1.0-6	low		927903

Notes

[jessie] - wavpack <not-affected> (Vulnerable code not present, introduced in 5.0.0)
https://github.com/dbry/WavPack/issues/67
https://github.com/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4