CVE-2018-10537: debian debian_linux

CVSS: 7.8v3.0HighModified

AliasesALPINE-CVE-2018-10537UBUNTU-CVE-2018-10537DEBIAN-CVE-2018-10537

Published 29-04-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-10537 is a high (CVSS 7.8) vulnerability in debian debian_linux. EPSS estimates a 2.02% chance of exploitation in the next 30 days, higher than 80.6% of scored vulnerabilities.

Overall risk

32/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.0 (NVD)

EPSS score

2.02%

0%100%

Low · -0.04 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 4

DSA-4197-1 MGASA-2019-0045 OPENSUSE-SU-2021:0153-1 OPENSUSE-SU-2021:0154-1 SUSE-SU-2021:0186-1 USN-3637-1

Timeline

29-04-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.07.8v2.06.8

EPSS trend

Probability

2.02%

Chance of exploitation in the next 30 days

Percentile

81%

Versus all other CVEs

30-day change

-0.04 pp

From 2.06% on 18-09-2026

18-09-202618-10-2026

EPSS score

2.02%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Debian2 products

wavpack< 5.1.0-3
debian_linuxEOL8.0 | 9.0

Alpine1 product

wavpack< 5.1.0-r6 | < 5.1.0-r2

Ubuntu1 product

wavpack< 5.1.0-2ubuntu1.1

Wavpack1 product

wavpack≤ 5.1.0

4 vendors · 5 products

References

15 links

github.com/dbry/WavPack/issues/32X Refsource MISCIssue TrackingThird Party AdvisoryREPORT
www.debian.org/security/2018/dsa-4197Vendor AdvisoryX Refsource DEBIANThird Party Advisory
github.com/dbry/WavPack/issues/31X Refsource MISCIssue TrackingThird Party AdvisoryREPORT
usn.ubuntu.com/3637-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
github.com/dbry/WavPack/issues/30X Refsource MISCIssue TrackingThird Party AdvisoryREPORT
github.com/dbry/WavPack/commit/26cb47f99d481ad9b93eeff80d26e6b63bbd7e15X Refsource MISCPatchThird Party AdvisoryREPORT
seclists.org/bugtraq/2019/Dec/37Mailing ListX Refsource BUGTRAQ
packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.htmlX Refsource MISC
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA

Show all 15 references

security.alpinelinux.org/vuln/CVE-2018-10537Advisory
ubuntu.com/security/CVE-2018-10537REPORT
ubuntu.com/security/notices/USN-3637-1Advisory
www.cve.org/CVERecord?id=CVE-2018-10537REPORT
security-tracker.debian.org/tracker/CVE-2018-10537Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities