oss-sec mailing list archives
Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow
From: Kurt Seifried <kseifried () redhat com>
Date: Fri, 09 Aug 2013 22:42:44 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/07/2013 11:29 AM, Florian wrote:
On 07/08/2013 19:17, Kurt Seifried wrote:On 08/07/2013 10:24 AM, Florian wrote:Hi,Just a CVE Request for this http://blog.scrt.ch/2013/07/24/vlc-abc-parsing-seems-to-be-a-ctf-challenge/
Thx
I need a better request. You want one CVE? multiple CVEs? A quick read of the web page indicates multiple different problems. Can you list them here and provide links to the source code? thanks.Okay, so the first bug is an integer overflow in j variable, it occurs here : https://github.com/gardaud/libmodplug/blob/master/src/load_abc.cpp#L1852
Please
use CVE-2013-4233 for this issue.
The second bug is a heap overflow and can be triggered in two functions abc_MIDI_drum : https://github.com/gardaud/libmodplug/blob/master/src/load_abc.cpp#L3211
and
abc_MIDI_gchord : https://github.com/gardaud/libmodplug/blob/master/src/load_abc.cpp#L3258 h->gchord and h->drum are static buffers and are filled until the copied byte is in the charset (respectively 'fbcz0123456789ghijGHIJ' and 'dz0123456789')
Please use CVE-2013-4234 for this issue.
It's up to you to open one or multiple CVE.
Nope. http://cve.mitre.org/cve/editorial_policies/cd_abstraction.html I gotta follow to rules like everyone else.
Don't hesitate if you want more information. Thx
- -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJSBcTEAAoJEBYNRVNeJnmT6vEP/R1SVk6KRnwtW7queqL/UDg/ Ji7SswSe2GBSNKmLdanWnhOJLeJsi2LjVv98U1rRR9bBxKE3BLkat/aTiM3ZACai KmFMIDtiSLAO+iz6pAuE6Ddko2fDdCw4K5RaGkAVatdrqVyW6SH98Zfj171yVJED GqO1TOm4xEQGPywZd+RKj6Q++yVmOQQxfyZ9cZTX6WHdZDeEhtVJtPJ3zSqquO7q En10K6dp8JYfB6l5qLf7yedhuSWchIZUlWqvLcv2dG1t295o5mru3Mri4xcWyFMp oluxgu20e7sTMjlxkByJQ2vT/ho8htTXlL3B5YtHtnsSsOspcak9/uQhvwrKeouY kAO0KHjVVdhA7uk6wpVyFjnXgVFkweSg1DnMl2sDHMf/GWKnuU+CnyT3kJzGvtAM TOQM77YsP+xowGfh62bZWgcz1UJH/00rIbWU/Edht37ZfhSikNhH00b7+QZGLh+K LVDWf+Ifpv1GMpshkpcAk/CfZSOp9nOyxFou2InM5EvHvdtWspdI5lxLSUZxBq1I bNoc8X5WF+wmjI8gWbiv/tddrX/JP+Qza3ogeG9kOdetr6CHICen3FaEvzMh3OZa 9rp3iLdLJ+SVhhTpDAK4FcsuplX4yPpjTv5sFSacgrDb9JLqsMGDkjSH5ZiG9Mni esHtKi+2ApgHYHbnnpo0 =x9Ym -----END PGP SIGNATURE-----
Current thread:
- Re: CVE Request - MongoDB <=2.4.4 uninitialized object, (continued)
- Re: CVE Request - MongoDB <=2.4.4 uninitialized object Kurt Seifried (Jul 17)
- Re: CVE Request - MongoDB <=2.4.4 uninitialized object Dan Pasette (Jul 18)
- Re: CVE Request - MongoDB <=2.4.4 uninitialized object Moritz Muehlenhoff (Jul 18)
- Re: CVE Request - MongoDB <=2.4.4 uninitialized object Kurt Seifried (Jul 18)
- Re: CVE Request - MongoDB <=2.4.4 uninitialized object Kurt Seifried (Jul 26)
- Re: CVE Request - MongoDB <=2.4.4 uninitialized object Andreas Nilsson (Jul 30)
- Re: CVE Request - MongoDB <=2.4.4 uninitialized object Dan Pasette (Jul 18)
- Re: CVE Request - MongoDB <=2.4.4 uninitialized object Moritz Muehlenhoff (Jul 22)
- Re: CVE Request - MongoDB <=2.4.4 uninitialized object Kurt Seifried (Jul 17)
- Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow Kurt Seifried (Aug 07)
- Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow Florian (Aug 07)
- Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow Kurt Seifried (Aug 09)
- Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow Raphael Geissert (Aug 12)