PT-2017-11915 · Openmpt · Openmpt+1

Sagamusix · Published 2017-07-13 · Updated 2017-07-27 · CVE-2017-11311

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenMPT versions prior to 1.26.12.00 libopenmpt versions prior to 0.2.8461-beta26

Description The issue is related to a heap buffer overflow that could potentially lead to arbitrary code execution. This occurs when a crafted PSM file is used, causing the same sample slot to be used for two samples.

Recommendations For OpenMPT versions prior to 1.26.12.00, update to version 1.26.12.00 or later to resolve the issue. For libopenmpt versions prior to 0.2.8461-beta26, update to version 0.2.8461-beta26 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-11311

OPENSUSE-SU-2024:10965-1

Affected Products

Openmpt

Libopenmpt

References · 8

• https://security-tracker.debian.org/tracker/CVE-2017-11311 · Vendor Advisory
• https://lib.openmpt.org/libopenmpt/md_announce-2017-07-07.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-11311 · Vendor Advisory
• https://source.openmpt.org/browse/openmpt/branches/OpenMPT-1.26/?op=revision&rev=8438 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-11311 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11311 · Vendor Advisory
• https://source.openmpt.org/browse/openmpt/trunk/?rev=6800 · Patch
• https://bugs.debian.org/867579 · Patch