Off-by-One Error in libmodplug Affects Multiple Platforms
CVE-2011-2914

Currently unrated

Key Information:

Vendor: Konstanty Bialkowski
Status: LIBModplug
Vendor: CVE Published:; 7 June 2012

🔔 Create Konstanty Bialkowski Vulnerability Alert

What is CVE-2011-2914?

The identified vulnerability in libmodplug stems from an off-by-one error in the CSoundFile::ReadDSM function located in src/load_dms.cpp. This flaw may allow attackers to corrupt memory and potentially execute arbitrary code if a specially crafted DSM file is processed. Users of affected versions prior to 0.8.8.4 are strongly advised to update their software to mitigate these risks, as exploitation can occur through the manipulation of a file containing a large number of samples.

References

http://lists.fedoraproject.org/pipermail/package-announce...

vendor-advisoryx_refsource_FEDORA

http://www.openwall.com/lists/oss-security/2011/08/10/4

mailing-listx_refsource_MLIST

http://www.debian.org/security/2012/dsa-2415

vendor-advisoryx_refsource_DEBIAN

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 7, 2012
Vulnerability Reserved
Jul 27, 2011

CVE-2011-2914 Data

JSON