PT-2019-4197 · Openmpt+2 · Libopenmpt+2

Antonio Morales Maldonado · Published 2019-10-03 · Updated 2026-04-23 · CVE-2019-17113

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libopenmpt versions prior to 0.3.19 libopenmpt versions 0.4.x prior to 0.4.9

Description The issue is related to the functions ModPlug InstrumentName and ModPlug SampleName in libopenmpt modplug.c, which do not properly restrict the lengths of output-buffer strings. This can lead to a buffer overflow, allowing a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For libopenmpt versions prior to 0.3.19, update to version 0.3.19 or later. For libopenmpt versions 0.4.x prior to 0.4.9, update to version 0.4.9 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2019-04793

CVE-2019-17113

DLA-2308-1

DSA-4729-1

OPENSUSE-SU-2019:2306-1

OPENSUSE-SU-2019:2319-1

OPENSUSE-SU-2019_2306-1

OPENSUSE-SU-2019_2319-1

OPENSUSE-SU-2024:10965-1

SUSE-SU-2019:2622-1

SUSE-SU-2019_2622-1

USN-8206-1

Affected Products

Suse

Ubuntu

Libopenmpt

References · 34

• https://github.com/OpenMPT/openmpt/commit/927688ddab43c2b203569de79407a899e734fabe · Patch
• https://github.com/OpenMPT/openmpt/compare/libopenmpt-0.3.18...libopenmpt-0.3.19 · Patch
• https://github.com/OpenMPT/openmpt/compare/libopenmpt-0.4.8...libopenmpt-0.4.9 · Patch
• https://ubuntu.com/security/CVE-2019-17113 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17113 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17113 · Security Note
• https://source.openmpt.org/browse/openmpt/trunk/OpenMPT/?op=revision&rev=12127&peg=12127 · Patch
• https://osv.dev/vulnerability/CVE-2019-17113 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2622-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2319-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8206-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2308-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8206-1 · Vendor Advisory