oss-sec mailing list archives
Re: CVE Request -- libmodplug
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Wed, 29 Apr 2009 12:58:27 +0200
Hello Steve, apologize for not sending these all at once, but noticed the following one only today. There is another buffer overflow (DoS) vulnerability in libmodplug -- this time in PAT sample loader. Referecences: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526084 http://sourceforge.net/tracker/?func=detail&aid=2777467&group_id=1275&atid=301275 http://secunia.com/advisories/34927 http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_pat.cpp?r1=1.3&r2=1.4 (patch) Thanks, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
On Tue, 2009-04-21 at 14:47 +0200, Jan Lieskovsky wrote:Hello Steve, could you please allocate a new CVE-2008-XXXX identifier for the following old libmodplug issue: References: http://bugs.gentoo.org/show_bug.cgi?id=266913 http://www.securityfocus.com/bid/30801/info http://sourceforge.net/project/shownotes.php?release_id=677065&group_id=1275 https://bugzilla.redhat.com/show_bug.cgi?id=496834 Affected libmodplug versions: x < 0.8.6 Patch (against modplug-xmms/libmodplug): http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&r2=1.2 Thanks, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE Request -- libmodplug Jan Lieskovsky (Apr 21)
- Re: CVE Request -- libmodplug Jan Lieskovsky (Apr 27)
- Re: CVE Request -- libmodplug Jan Lieskovsky (Apr 29)
- Re: CVE Request -- libmodplug Steven M. Christey (May 21)
- Re: CVE Request -- libmodplug Jan Lieskovsky (Apr 29)
- Re: CVE Request -- libmodplug Steven M. Christey (May 21)
- Re: CVE Request -- libmodplug Jan Lieskovsky (Apr 27)