CVE-2018-10017: Medium severity libopenmpt0 vulnerability
soundlib/Sndfx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern loops.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is most likely to be exposed, and what does exploitation require?
Systems that process untrusted IT or MO3 audio module files are exposed. Exploitation requires a user or application to open a crafted file containing many nested pattern loops; no attacker authentication or special privileges are required.
What is the practical impact of a successful exploit?
The reported impact is denial of service caused by an out-of-bounds read. The CVSS vector indicates network delivery is possible but user interaction is required, consistent with a crafted file needing to be opened or processed.
What versions contain the fix?
Update OpenMPT to 1.27.07.00 or later, or libopenmpt to 0.3.8 or later. A patch is available.