CVE-2019-11498

WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.

• CWE-824

• https://github.com/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4Patch, Third Party Advisory
• https://github.com/dbry/WavPack/issues/67Exploit, Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/01/msg00013.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZDKXGA2ZNSSM64ZYDHOWCO4Q4VAKAON/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SCK2YJXY6V5CKGKSF2PPN7RL2DXVOC6G/
• https://security.gentoo.org/glsa/202007-19Third Party Advisory
• https://usn.ubuntu.com/3960-1/Third Party Advisory
• https://github.com/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4Patch, Third Party Advisory
• https://github.com/dbry/WavPack/issues/67Exploit, Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/01/msg00013.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZDKXGA2ZNSSM64ZYDHOWCO4Q4VAKAON/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SCK2YJXY6V5CKGKSF2PPN7RL2DXVOC6G/
• https://security.gentoo.org/glsa/202007-19Third Party Advisory
• https://usn.ubuntu.com/3960-1/Third Party Advisory

Published

Apr 24, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11492ProjectSend before r1070 writes user passwords to the server…
• CVE-2019-11493VeryPDF 4.1 has a Memory Overflow leading to Code Execution …
• CVE-2019-11494In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the sub…7.5
• CVE-2019-11495In Couchbase Server 5.1.1, the cookie used for intra-node co…9.8
• CVE-2019-11496In versions of Couchbase Server prior to 5.0, the bucket nam…9.1
• CVE-2019-11497In Couchbase Server 5.0.0, when an invalid Remote Cluster Ce…7.5
• CVE-2019-11499In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the sub…7.5
• CVE-2019-1150A remote code execution vulnerability exists when the Window…8.8
• CVE-2019-11500In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pig…
• CVE-2019-11502snap-confine in snapd before 2.38 incorrectly set the owners…
• CVE-2019-11503snap-confine as included in snapd before 2.39 did not guard …
• CVE-2019-11504Zotonic before version 0.47 has mod_admin XSS.