PT-2012-1103 · Modplug+1 · Libmodplug+1

Published 2011-09-06 · Updated 2023-02-13 · CVE-2011-2911

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libmodplug versions prior to 0.8.8.4

Description The issue is related to multiple vulnerabilities in the libmodplug package, which can be exploited remotely. This exploitation may lead to a breach of confidentiality, integrity, and availability of protected information. Specifically, an integer overflow in the CSoundFile::ReadWav function in src/load wav.cpp can cause a denial of service and potentially allow the execution of arbitrary code via a crafted WAV file, triggering a heap-based buffer overflow.

Recommendations For versions prior to 0.8.8.4, update to version 0.8.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to WAV files or disabling the CSoundFile::ReadWav function until a patch is applied. Avoid using the CSoundFile::ReadWav function with untrusted WAV files until the issue is resolved.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-189

Related Identifiers

BDU:2015-09436

CVE-2011-2911

DSA-2415-1

RHSA-2011:1264

RHSA-2011_1264

Affected Products

Red Hat

Libmodplug

References · 38

• http://secunia.com/advisories/45658 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066044.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063786.html · Vendor Advisory
• http://secunia.com/advisories/48058 · Vendor Advisory
• http://secunia.com/advisories/48434 · Vendor Advisory
• http://secunia.com/advisories/46043 · Vendor Advisory
• http://secunia.com/advisories/46793 · Vendor Advisory
• http://debian.org/security/2012/dsa-2415 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-201203-14.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2911 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-2911 · Vendor Advisory
• http://ubuntu.com/usn/usn-1255-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1264.html · Vendor Advisory
• http://secunia.com/advisories/45901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2911 · Security Note