oss-security - Re: CVE Request -- libmodplug

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 27 Apr 2009 17:36:26 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Konstanty <konstanty@...il.com>
Subject: Re: CVE Request -- libmodplug

Hello Steve,

  FYI Konstanty has added more checks (for // Sample Names
potential overflow) and also null terminations for
relevant strings (to ensure string safety) at:

http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.2&amp;amp;amp;r2=1.3&amp;amp;amp;view=patch

So new 0.8.7 release of libmodplug is available.

Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

On Tue, 2009-04-21 at 14:47 +0200, Jan Lieskovsky wrote:
> Hello Steve,
> 
>   could you please allocate a new CVE-2008-XXXX identifier for
> the following old libmodplug issue:
> 
> References:
> http://bugs.gentoo.org/show_bug.cgi?id=266913
> http://www.securityfocus.com/bid/30801/info
> http://sourceforge.net/project/shownotes.php?release_id=677065&amp;group_id=1275
> https://bugzilla.redhat.com/show_bug.cgi?id=496834
> 
> Affected libmodplug versions: x < 0.8.6
> 
> Patch (against modplug-xmms/libmodplug):
> http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&amp;r2=1.2
> 
> Thanks, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
> 
> 
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.