CVE-2017-11311: Buffer Overflow

Q: Who is realistically exposed to this issue?

Systems that process untrusted PSM files with affected OpenMPT or libopenmpt versions are exposed. The vulnerable code is present in OpenMPT through 1.26.12.00 and libopenmpt releases before 0.2.8461-beta26.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to persuade a user or application to open a specially crafted PSM file. No privileges are required, but user interaction is required according to the CVSS vector.

Q: What should be done if the affected software is in use?

Apply the available patch by upgrading beyond the affected version ranges. The provided data does not identify a separate configuration change or workaround.

Published Jul 13, 2017

Updated

soundlib/Loadpsm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential for arbitrary code execution via a crafted PSM File that triggers use of the same sample slot for two samples.

Affected Software

2 affected components

libopenmpt0<=0.2.8414

OpenMPT OpenMPT<=1.26.12.00

Remediation

Event History

Jul 13, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems that process untrusted PSM files with affected OpenMPT or libopenmpt versions are exposed. The vulnerable code is present in OpenMPT through 1.26.12.00 and libopenmpt releases before 0.2.8461-beta26.

What does an attacker need to exploit the vulnerability?

An attacker needs to persuade a user or application to open a specially crafted PSM file. No privileges are required, but user interaction is required according to the CVSS vector.

What should be done if the affected software is in use?

Apply the available patch by upgrading beyond the affected version ranges. The provided data does not identify a separate configuration change or workaround.

CVE-2017-11311: Buffer Overflow

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

What should be done if the affected software is in use?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

What should be done if the affected software is in use?