PT-2012-1107 · Modplug+1 · Libmodplug+1
CVE-2011-2915
·
Published
2011-09-06
·
Updated
2023-02-13
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
libmodplug versions prior to 0.8.8.4
Description
The issue is related to multiple vulnerabilities in the libmodplug package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, an off-by-one error in the
CSoundFile::ReadAMS2 function allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted AMS file with a large number of instruments.Recommendations
For libmodplug versions prior to 0.8.8.4, update to version 0.8.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to AMS files or disabling the
CSoundFile::ReadAMS2 function until a patch is available. Avoid using crafted AMS files with a large number of instruments in the affected API endpoint until the issue is resolved.Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat
Libmodplug