CVE-2020-35738 log

Source
Severity Medium
Remote No
Type Arbitrary code execution
Description
WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument.
Group Package Affected Fixed Severity Status Ticket
AVG-1387 wavpack 5.3.0-1 5.3.0-2 Medium Fixed FS#69234
Date Advisory Group Package Severity Type
12 Jan 2021 ASA-202101-23 AVG-1387 wavpack Medium arbitrary code execution
References
https://github.com/dbry/WavPack/issues/91
https://github.com/dbry/WavPack/files/5745022/crash.wav.tar.gz
https://github.com/dbry/WavPack/commit/63f3ec70129843dd64e11aa4c21c4a1cf00c9f1c
https://github.com/dbry/WavPack/commit/89df160596132e3bd666322e1c20b2ebd4b92cd0