PT-2012-1105 · Modplug+1 · Libmodplug+1

Published 2011-09-06 · Updated 2023-02-13 · CVE-2011-2913

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libmodplug versions prior to 0.8.8.4

Description The issue is related to an off-by-one error in the CSoundFile::ReadAMS function, which can be exploited by remote attackers using a crafted AMS file with a large number of samples. This could lead to a denial of service due to stack memory corruption and potentially allow the execution of arbitrary code. Additionally, there are multiple vulnerabilities in the libmodplug package that can compromise the confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For libmodplug versions prior to 0.8.8.4, update to version 0.8.8.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the CSoundFile::ReadAMS function until a patch is available. Avoid using libmodplug with untrusted AMS files until the issue is resolved.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-189

Related Identifiers

BDU:2015-09436

CVE-2011-2913

DSA-2415-1

RHSA-2011:1264

RHSA-2011_1264

Affected Products

Red Hat

Libmodplug

References · 38

• http://secunia.com/advisories/45658 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066044.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063786.html · Vendor Advisory
• http://secunia.com/advisories/48058 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-2913 · Vendor Advisory
• http://secunia.com/advisories/48434 · Vendor Advisory
• http://secunia.com/advisories/46043 · Vendor Advisory
• http://secunia.com/advisories/46793 · Vendor Advisory
• http://secunia.com/advisories/46032 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2913 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-201203-14.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-1255-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-2913 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1264.html · Vendor Advisory
• http://secunia.com/advisories/45901 · Vendor Advisory