oss-sec mailing list archives
Re: CVE Request -- libmodplug
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Mon, 27 Apr 2009 17:36:26 +0200
Hello Steve, FYI Konstanty has added more checks (for // Sample Names potential overflow) and also null terminations for relevant strings (to ensure string safety) at: http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.2&amp;amp;r2=1.3&amp;amp;view=patch So new 0.8.7 release of libmodplug is available. Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team On Tue, 2009-04-21 at 14:47 +0200, Jan Lieskovsky wrote:
Hello Steve, could you please allocate a new CVE-2008-XXXX identifier for the following old libmodplug issue: References: http://bugs.gentoo.org/show_bug.cgi?id=266913 http://www.securityfocus.com/bid/30801/info http://sourceforge.net/project/shownotes.php?release_id=677065&group_id=1275 https://bugzilla.redhat.com/show_bug.cgi?id=496834 Affected libmodplug versions: x < 0.8.6 Patch (against modplug-xmms/libmodplug): http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&r2=1.2 Thanks, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE Request -- libmodplug Jan Lieskovsky (Apr 21)
- Re: CVE Request -- libmodplug Jan Lieskovsky (Apr 27)
- Re: CVE Request -- libmodplug Jan Lieskovsky (Apr 29)
- Re: CVE Request -- libmodplug Steven M. Christey (May 21)
- Re: CVE Request -- libmodplug Jan Lieskovsky (Apr 29)
- Re: CVE Request -- libmodplug Steven M. Christey (May 21)
- Re: CVE Request -- libmodplug Jan Lieskovsky (Apr 27)