CVE-2019-17113

CVE-2019-17113 affects libopenmpt (libopenmpt_modplug.c) before 0.3.19 and 0.4.x before 0.4.9, where ModPlug_InstrumentName/ModPlug_SampleName do not enforce output-buffer string length limits in the C API, enabling a buffer overflow. The issue is fixed in 0.3.19 and 0.4.9 releases; upgrading to ...

CVE-2019-14383

CVE-2019-14383 affects libopenmpt prior to 0.4.2, where J2B parsing can trigger an assertion failure when handling debug STLs. Multiple third‑party advisories (SUSE/openSUSE updates and related OSS/OSV listings) confirm this vulnerability and show a fix was released in libopenmpt 0.4.2 and newer....

CVE-2019-14382

The CVE-2019-14382 issue affects libopenmpt, specifically DSM handling during parsing of debug STL files, caused by an assertion failure in the parser prior to version 0.4.2. Multiple connected sources (SUSE/OpenSUSE advisories and OSV entries) confirm the vulnerable component and list the same r...

CVE-2018-20860

CVE-2018-20860 affects libopenmpt prior to 0.3.13, causing a crash when handling malformed MED files. The connected updates indicate a security fix in libopenmpt to address this crash (and related fixes for CVE-2018-20861, CVE-2019-14382, CVE-2019-14383) across openSUSE/SLE SUSE update advisories...

CVE-2018-20861

CVE-2018-20861 affects libopenmpt prior to 0.3.11, causing a crash when parsing certain malformed MPTM tunings in MPTM files. Multiple openSUSE/SUSE advisories and OSV entries document the fix as part of libopenmpt updates (e.g., openSUSE-SU-2019:2212/2213) that address this vulnerability alongsi...

CVE-2019-14380

CVE-2019-14380 affects libopenmpt up to 0.4.4 (pre-0.4.5); the issue is an out-of-bounds read in XM and MT2 playback that can crash the application. Debian/DSA notes a fix in libopenmpt with a security update (0.4.3-1+deb10u1); other references corroborate a vulnerability in the library before 0....

CVE-2018-10017

CVE-2018-10017 affects OpenMPT up to 1.27.07.00 and libopenmpt up to 0.3.8, enabling a remote attacker to cause a denial of service via IT/MO3 files with many nested pattern loops (out-of-bounds read). Connected advisories confirm fixes in libopenmpt 0.3.9 and OpenMPT 1.27.07.00. Recommended reme...

CVE-2018-11710

CVE-2018-11710 affects libopenmpt up to version 0.3.8, where AMS file handling could trigger an out-of-memory write near address 0, potentially causing a crash or unspecified impact. The issue is addressed by upgrading to libopenmpt 0.3.9, as documented in multiple advisories (e.g., SUSE/OpenSUSE...

CVE-2017-11311

OpenMPT (through 1.26.12.00) and libopenmpt (before 0.2.8461-beta26) contain a heap buffer overflow in soundlib/Load_psm.cpp triggered by a crafted PSM file that reuses the same sample slot for two samples, potentially enabling arbitrary code execution. Affected components include OpenMPT and the...

CVE-2018-6611

CVE-2018-6611 affects OpenMPT (soundlib/Load_stp.cpp) through 1.27.04.00 and libopenmpt before 0.3.6, with an out-of-bounds read triggered by a malformed STP file. Connected docs confirm the vulnerable components and versions, and indicate a fix in libopenmpt 0.3.6 (security update). Impact is a ...

CVE-2019-14381

The CVE-2019-14381 affects libopenmpt up to version 0.4.2; the root cause is a NULL pointer dereference when performing a portamento from an OPL instrument to an empty instrument note map slot, causing a crash. Public references indicate a security update released with release 0.4.3 to address th...