Date: Wed, 10 Aug 2011 20:26:46 +0200 From: Tomas Hoger <thoger@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE request: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3 On Wed, 10 Aug 2011 10:27:18 +0200 Thomas Biege wrote: > The 2nd issue seems to be CVE-2011-1574 other seem to be untracked. ... > 2) Boundary errors within the "CSoundFile::ReadS3M()" function > (src/load_s3m.cpp) when processing S3M files can be exploited to cause > stack-based buffer overflows by tricking a user into opening a > specially crafted S3M file. Any specific reason to believe these two are the same? CVE-2011-1574 links: http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=aecef259828a89bb00c2e6f78e89de7363b2237b while commit related to SA45131/2 seems to be this one: >  > http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=f4e5295658fff000379caa122e75c9200205fe20 -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.