oss-security - Re: CVE Request -- libmodplug

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 29 Apr 2009 12:58:27 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Konstanty <konstanty@...il.com>
Subject: Re: CVE Request -- libmodplug

Hello Steve,

  apologize for not sending these all at once, but noticed
  the following one only today. There is another buffer
  overflow (DoS) vulnerability in libmodplug -- this time 
  in PAT sample loader.

  Referecences:
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526084
  http://sourceforge.net/tracker/?func=detail&aid=2777467&group_id=1275&atid=301275
  http://secunia.com/advisories/34927
  http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_pat.cpp?r1=1.3&r2=1.4 (patch)

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> On Tue, 2009-04-21 at 14:47 +0200, Jan Lieskovsky wrote:
> > Hello Steve,
> > 
> >   could you please allocate a new CVE-2008-XXXX identifier for
> > the following old libmodplug issue:
> > 
> > References:
> > http://bugs.gentoo.org/show_bug.cgi?id=266913
> > http://www.securityfocus.com/bid/30801/info
> > http://sourceforge.net/project/shownotes.php?release_id=677065&amp;group_id=1275
> > https://bugzilla.redhat.com/show_bug.cgi?id=496834
> > 
> > Affected libmodplug versions: x < 0.8.6
> > 
> > Patch (against modplug-xmms/libmodplug):
> > http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&amp;r2=1.2
> > 
> > Thanks, Jan.
> > --
> > Jan iankko Lieskovsky / Red Hat Security Response Team
> > 
> > 
> > 
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.