oss-sec mailing list archives

Re: CVE Request -- libmodplug

From: Jan Lieskovsky <jlieskov () redhat com>
Date: Mon, 27 Apr 2009 17:36:26 +0200

Hello Steve,

  FYI Konstanty has added more checks (for // Sample Names
potential overflow) and also null terminations for
relevant strings (to ensure string safety) at:

http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.2&amp;amp;amp;r2=1.3&amp;amp;amp;view=patch

So new 0.8.7 release of libmodplug is available.

Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

On Tue, 2009-04-21 at 14:47 +0200, Jan Lieskovsky wrote:

Hello Steve,

  could you please allocate a new CVE-2008-XXXX identifier for
the following old libmodplug issue:

References:
http://bugs.gentoo.org/show_bug.cgi?id=266913
http://www.securityfocus.com/bid/30801/info
http://sourceforge.net/project/shownotes.php?release_id=677065&amp;group_id=1275
https://bugzilla.redhat.com/show_bug.cgi?id=496834

Affected libmodplug versions: x < 0.8.6

Patch (against modplug-xmms/libmodplug):
http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&amp;r2=1.2

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Current thread:

CVE Request -- libmodplug Jan Lieskovsky (Apr 21)
- Re: CVE Request -- libmodplug Jan Lieskovsky (Apr 27)
  - Re: CVE Request -- libmodplug Jan Lieskovsky (Apr 29)
    - Re: CVE Request -- libmodplug Steven M. Christey (May 21)
- Re: CVE Request -- libmodplug Steven M. Christey (May 21)