CVE-2022-2476: 
NixOS vulnerability analysis and mitigation

A null pointer dereference vulnerability (CVE-2022-2476) was discovered in WavPack version 5.4.0. The vulnerability was identified in July 2022 and affects the main() function located in the cli/wvunpack.c file (NVD, GitHub Issue).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) occurring in the main() function at cli/wvunpack.c. The issue manifests as a SEGV (segmentation violation) caused by a WRITE memory access to address 0x000000000000. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

If exploited, this vulnerability could allow an attacker to cause the WavPack decompressor to crash, resulting in a denial of service condition. The vulnerability requires user interaction, as it is triggered when a user is tricked into decompressing a specially crafted WavPack Audio File (Ubuntu Security).

The vulnerability has been fixed in subsequent releases of WavPack. Users are advised to update their systems to the latest available version. For Ubuntu 16.04 ESM users, the fixed package versions are libwavpack1 - 4.75.2-2ubuntu0.2+esm1 and wavpack - 4.75.2-2ubuntu0.2+esm1 (Ubuntu Security).