Re: CVE Request -- libmodplug

[Jan Lieskovsky <jlieskov () redhat com>]

Hello Steve,

  apologize for not sending these all at once, but noticed
  the following one only today. There is another buffer
  overflow (DoS) vulnerability in libmodplug -- this time 
  in PAT sample loader.

  Referecences:
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526084
  http://sourceforge.net/tracker/?func=detail&aid=2777467&group_id=1275&atid=301275
  http://secunia.com/advisories/34927
  http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_pat.cpp?r1=1.3&r2=1.4 (patch)

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> On Tue, 2009-04-21 at 14:47 +0200, Jan Lieskovsky wrote:
> > Hello Steve,
> >
> >   could you please allocate a new CVE-2008-XXXX identifier for
> > the following old libmodplug issue:
> >
> > References:
> > http://bugs.gentoo.org/show_bug.cgi?id=266913
> > http://www.securityfocus.com/bid/30801/info
> > http://sourceforge.net/project/shownotes.php?release_id=677065&group_id=1275
> > https://bugzilla.redhat.com/show_bug.cgi?id=496834
> >
> > Affected libmodplug versions: x < 0.8.6
> >
> > Patch (against modplug-xmms/libmodplug):
> > http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&amp;r2=1.2
> >
> > Thanks, Jan.
> > --
> > Jan iankko Lieskovsky / Red Hat Security Response Team