Lucene search

DebianDEBIAN:DLA-2308-1:86CEE

HistoryAug 01, 2020 - 10:49 p.m.

[SECURITY] [DLA 2308-1] libopenmpt security update

2020-08-0122:49:41

lists.debian.org

libopenmpt

buffer overflow

debian 9

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.017

Percentile

88.2%

JSON

Debian LTS Advisory DLA-2308-1 [email protected]
https://www.debian.org/lts/security/ Utkarsh Gupta
August 02, 2020 https://wiki.debian.org/LTS

Package : libopenmpt
Version : 0.2.7386~beta20.3-3+deb9u4
CVE ID : CVE-2019-17113

In libopenmpt before 0.3.19 and 0.4.x before 0.4.9,
ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c
do not restrict the lengths of libmodplug output-buffer strings in
the C API, leading to a buffer overflow.

For Debian 9 stretch, this problem has been fixed in version
0.2.7386~beta20.3-3+deb9u4.

We recommend that you upgrade your libopenmpt packages.

For the detailed security status of libopenmpt please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libopenmpt

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Best,
Utkarsh

OSVersionArchitecturePackageVersionFilename
Debian9arm64openmpt123< 0.2.7386~beta20.3-3+deb9u4openmpt123_0.2.7386~beta20.3-3+deb9u4_arm64.deb
Debian10mipsopenmpt123-dbgsym< 0.4.3-1+deb10u1openmpt123-dbgsym_0.4.3-1+deb10u1_mips.deb
Debian10amd64libopenmpt-modplug1< 0.4.3-1+deb10u1libopenmpt-modplug1_0.4.3-1+deb10u1_amd64.deb
Debian10s390xopenmpt123< 0.4.3-1+deb10u1openmpt123_0.4.3-1+deb10u1_s390x.deb
Debian9arm64libopenmpt0< 0.2.7386~beta20.3-3+deb9u4libopenmpt0_0.2.7386~beta20.3-3+deb9u4_arm64.deb
Debian10mips64ellibopenmpt-modplug1< 0.4.3-1+deb10u1libopenmpt-modplug1_0.4.3-1+deb10u1_mips64el.deb
Debian10mips64ellibopenmpt-modplug-dev< 0.4.3-1+deb10u1libopenmpt-modplug-dev_0.4.3-1+deb10u1_mips64el.deb
Debian10arm64openmpt123< 0.4.3-1+deb10u1openmpt123_0.4.3-1+deb10u1_arm64.deb
Debian10mipslibopenmpt0-dbgsym< 0.4.3-1+deb10u1libopenmpt0-dbgsym_0.4.3-1+deb10u1_mips.deb
Debian10mipsellibopenmpt0-dbgsym< 0.4.3-1+deb10u1libopenmpt0-dbgsym_0.4.3-1+deb10u1_mipsel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	arm64	openmpt123	< 0.2.7386~beta20.3-3+deb9u4	openmpt123_0.2.7386~beta20.3-3+deb9u4_arm64.deb
Debian	10	mips	openmpt123-dbgsym	< 0.4.3-1+deb10u1	openmpt123-dbgsym_0.4.3-1+deb10u1_mips.deb
Debian	10	amd64	libopenmpt-modplug1	< 0.4.3-1+deb10u1	libopenmpt-modplug1_0.4.3-1+deb10u1_amd64.deb
Debian	10	s390x	openmpt123	< 0.4.3-1+deb10u1	openmpt123_0.4.3-1+deb10u1_s390x.deb
Debian	9	arm64	libopenmpt0	< 0.2.7386~beta20.3-3+deb9u4	libopenmpt0_0.2.7386~beta20.3-3+deb9u4_arm64.deb
Debian	10	mips64el	libopenmpt-modplug1	< 0.4.3-1+deb10u1	libopenmpt-modplug1_0.4.3-1+deb10u1_mips64el.deb
Debian	10	mips64el	libopenmpt-modplug-dev	< 0.4.3-1+deb10u1	libopenmpt-modplug-dev_0.4.3-1+deb10u1_mips64el.deb
Debian	10	arm64	openmpt123	< 0.4.3-1+deb10u1	openmpt123_0.4.3-1+deb10u1_arm64.deb
Debian	10	mips	libopenmpt0-dbgsym	< 0.4.3-1+deb10u1	libopenmpt0-dbgsym_0.4.3-1+deb10u1_mips.deb
Debian	10	mipsel	libopenmpt0-dbgsym	< 0.4.3-1+deb10u1	libopenmpt0-dbgsym_0.4.3-1+deb10u1_mipsel.deb