oss-security - Re: CVE Request -- libmodplug

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 29 Apr 2009 12:58:27 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Konstanty <konstanty@...il.com>
Subject: Re: CVE Request -- libmodplug

Hello Steve,

  apologize for not sending these all at once, but noticed
  the following one only today. There is another buffer
  overflow (DoS) vulnerability in libmodplug -- this time 
  in PAT sample loader.

  Referecences:
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526084
  http://sourceforge.net/tracker/?func=detail&aid=2777467&group_id=1275&atid=301275
  http://secunia.com/advisories/34927
  http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_pat.cpp?r1=1.3&r2=1.4 (patch)

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> On Tue, 2009-04-21 at 14:47 +0200, Jan Lieskovsky wrote:
> > Hello Steve,
> > 
> >   could you please allocate a new CVE-2008-XXXX identifier for
> > the following old libmodplug issue:
> > 
> > References:
> > http://bugs.gentoo.org/show_bug.cgi?id=266913
> > http://www.securityfocus.com/bid/30801/info
> > http://sourceforge.net/project/shownotes.php?release_id=677065&amp;group_id=1275
> > https://bugzilla.redhat.com/show_bug.cgi?id=496834
> > 
> > Affected libmodplug versions: x < 0.8.6
> > 
> > Patch (against modplug-xmms/libmodplug):
> > http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&amp;r2=1.2
> > 
> > Thanks, Jan.
> > --
> > Jan iankko Lieskovsky / Red Hat Security Response Team
> > 
> > 
> > 
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.