{"affected":[{"ecosystem_specific":{"binaries":[{"libwavpack1":"5.4.0-lp152.7.3.1","libwavpack1-32bit":"5.4.0-lp152.7.3.1","wavpack":"5.4.0-lp152.7.3.1","wavpack-devel":"5.4.0-lp152.7.3.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.2","name":"wavpack","purl":"purl:rpm/suse/wavpack&distro=openSUSE%20Leap%2015.2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.4.0-lp152.7.3.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for wavpack fixes the following issues:\n\n- Update to version 5.4.0\n  * CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414) \n  * fixed: disable A32 asm code when building for Apple silicon\n  * fixed: issues with Adobe-style floating-point WAV files\n  * added: --normalize-floats option to wvunpack for correctly\n             exporting un-normalized floating-point files\n- Update to version 5.3.0 \n  * fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448\n  * fixed: trailing garbage characters on imported ID3v2 TXXX tags\n  * fixed: various minor undefined behavior and memory access issues\n  * fixed: sanitize tag extraction names for length and path inclusion\n  * improved: reformat wvunpack 'help' and split into long + short versions\n  * added: regression testing to Travis CI for OSS-Fuzz crashers\n- Updated to version 5.2.0 \n  *fixed: potential security issues including the following CVEs:\n         CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344),\n         CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342),  \n         CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), \n         CVE-2018-7254,  CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 \n         and CVE-2019-1010319\n  * added: support for CMake, Travis CI, and Google's OSS-fuzz\n  * fixed: use correction file for encode verify (pipe input, Windows)\n  * fixed: correct WAV header with actual length (pipe input, -i option)\n  * fixed: thumb interworking and not needing v6 architecture (ARM asm)\n  * added: handle more ID3v2.3 tag items and from all file types\n  * fixed: coredump on Sparc64 (changed MD5 implementation)\n  * fixed: handle invalid ID3v2.3 tags from sacd-ripper\n  * fixed: several corner-case memory leaks\n\nThis update was imported from the SUSE:SLE-15:Update update project.","id":"openSUSE-SU-2021:0153-1","modified":"2021-01-24T17:22:03Z","published":"2021-01-24T17:22:03Z","references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK4DH6BBB2WPBM677O7MFUOO5UBKUW37/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1091340"},{"type":"REPORT","url":"https://bugzilla.suse.com/1091341"},{"type":"REPORT","url":"https://bugzilla.suse.com/1091342"},{"type":"REPORT","url":"https://bugzilla.suse.com/1091343"},{"type":"REPORT","url":"https://bugzilla.suse.com/1091344"},{"type":"REPORT","url":"https://bugzilla.suse.com/1180414"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10536"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10537"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10538"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10539"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10540"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-19840"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-19841"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-6767"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-7253"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-7254"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-1010319"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-11498"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-35738"}],"related":["CVE-2018-10536","CVE-2018-10537","CVE-2018-10538","CVE-2018-10539","CVE-2018-10540","CVE-2018-19840","CVE-2018-19841","CVE-2018-6767","CVE-2018-7253","CVE-2018-7254","CVE-2019-1010319","CVE-2019-11498","CVE-2020-35738"],"summary":"Security update for wavpack"}