Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Aug 2011 20:26:46 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: libmodplug: multiple
 vulnerabilities reported in <= 0.8.8.3

On Wed, 10 Aug 2011 10:27:18 +0200 Thomas Biege wrote:

> The 2nd issue seems to be CVE-2011-1574 other seem to be untracked.

...

> 2) Boundary errors within the "CSoundFile::ReadS3M()" function
> (src/load_s3m.cpp) when processing S3M files can be exploited to cause
> stack-based buffer overflows by tricking a user into opening a
> specially crafted S3M file.

Any specific reason to believe these two are the same?  CVE-2011-1574
links:
http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=aecef259828a89bb00c2e6f78e89de7363b2237b

while commit related to SA45131/2 seems to be this one:

> [3]
> http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=f4e5295658fff000379caa122e75c9200205fe20

-- 
Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.