{"id":"CVE-2019-1010318","aliases":["EUVD-2019-2052","GHSA-fr6p-j5w9-5pc8","MGASA-2019-0230","MGASA-2019-0231","UBUNTU-CVE-2019-1010318","USN-4062-1","openSUSE-SU-2024:11505-1"],"status":"rejected","title":"WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is:...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11498. Reason: This candidate is a reservation duplicate of CVE-2019-11498. Notes: All CVE users should reference CVE-2019-11498 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-07-11T00:00:00Z","modified":"2026-04-22T12:05:18Z","fixes":[{"ecosystem":"Ubuntu:18.04:LTS","package":"wavpack","fixed_in":["5.1.0-2ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:6","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1.2.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:7","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-4.1.mga7"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-2ubuntu1.4"}]}],"versions":["5.1.0-2","5.1.0-2ubuntu1","5.1.0-2ubuntu1.1","5.1.0-2ubuntu1.2","5.1.0-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-2ubuntu1.4"}]}],"versions":["5.1.0-2","5.1.0-2ubuntu1","5.1.0-2ubuntu1.1","5.1.0-2ubuntu1.2","5.1.0-2ubuntu1.3"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1.6"}]}],"bundled":11}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010318"},{"url":"https://github.com/dbry/WavPack/issues/67","tags":["report"]},{"url":"https://github.com/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4","tags":["report"]},{"url":"https://github.com/advisories/GHSA-fr6p-j5w9-5pc8"},{"url":"https://advisories.mageia.org/MGASA-2019-0230.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25265","tags":["report"]},{"url":"https://usn.ubuntu.com/3960-1/","tags":["web"]},{"url":"https://usn.ubuntu.com/4062-1/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0231.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-1010318","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4062-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1010318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-1010315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-1010317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-1010319","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1010315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1010317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1010318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1010319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35738","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-1010318","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11498. Reason: This candidate is a reservation duplicate of CVE-2019-11498. Notes: All CVE users should reference CVE-2019-11498 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2019-07-11T19:23:52Z","modified":"2019-07-14T16:25:34Z","updated_at":"2026-11-02T14:20:24.989116Z"}],"euvd":[{"id":"EUVD-2019-2052","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11498. Reason: This candidate is a reservation duplicate of CVE-2019-11498. Notes: All CVE users should reference CVE-2019-11498 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2019-07-11T19:23:52Z","modified":"2019-07-14T16:25:34Z","updated_at":"2026-11-03T03:51:29.418182Z"}],"ghsa":[{"id":"GHSA-fr6p-j5w9-5pc8","title":"WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is:...","description":"WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: WavpackSetConfiguration64 (pack_utils.c:198). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4.","status":"published","published":"2022-05-24T16:50:03Z","modified":"2023-01-28T05:06:13Z","updated_at":"2026-11-02T14:44:24.844334Z"}],"nvd":[{"id":"CVE-2019-1010318","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11498. Reason: This candidate is a reservation duplicate of CVE-2019-11498. Notes: All CVE users should reference CVE-2019-11498 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2019-07-11T20:15:12.303Z","modified":"2023-11-07T03:02:20.323Z","updated_at":"2026-11-02T14:05:19.195714Z"}],"osv":[{"id":"MGASA-2019-0230","title":"Updated wavpack packages fix security vulnerabilities","description":"Updated wavpack packages fixes security vulnerabilities:\n\nIt was discovered that WavPack incorrectly handled certain DFF files.\nAn attacker could possibly use this issue to cause a denial of service\n(CVE-2019-11498).\n\nRohan Padhye discovered that WavPack incorrectly handled certain WAV files.\nAn attacker could possibly use this issue to cause a denial of service\n(CVE-2019-1010315, CVE-2019-1010317, CVE-2019-1010318, CVE-2019-1010319).\n","status":"published","published":"2019-08-31T13:22:36Z","modified":"2026-04-16T04:42:09.637397623Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2019-0231","title":"Updated wavpack packages fix security vulnerabilities","description":"Updated wavpack packages fixes security vulnerabilities:\n\nRohan Padhye discovered that WavPack incorrectly handled certain WAV files.\nAn attacker could possibly use this issue to cause a denial of service\n(CVE-2019-1010315, CVE-2019-1010317, CVE-2019-1010318, CVE-2019-1010319).\n","status":"published","published":"2019-08-31T13:22:36Z","modified":"2026-04-16T04:41:21.911570098Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11505-1","title":"libwavpack1-32bit-5.4.0-1.6 on GA media","description":"These are all security issues fixed in the libwavpack1-32bit-5.4.0-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:31:29.451178Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"UBUNTU-CVE-2019-1010318","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11498. Reason: This candidate is a reservation duplicate of CVE-2019-11498. Notes: All CVE users should reference CVE-2019-11498 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2019-07-11T00:00:00Z","modified":"2026-04-22T12:05:18.842249Z","updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"USN-4062-1","title":"wavpack vulnerabilities","description":"Rohan Padhye discovered that WavPack incorrectly handled certain WAV files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2019-1010315, CVE-2019-1010317, CVE-2019-1010318, CVE-2019-1010319)\n","status":"published","published":"2019-07-16T17:20:08Z","modified":"2026-04-22T09:59:25.097886Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}