CVE-2018-11710: High severity libopenmpt0 vulnerability
soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted AMS file because of an invalid write near address 0 in an out-of-memory situation.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems using libopenmpt versions before 0.3.9 are affected when they process a crafted AMS file. The issue is remotely reachable and does not require attacker privileges, but user interaction is required.
What does an attacker need to exploit it?
An attacker needs to provide a specially crafted AMS file that is processed by the vulnerable library. The vulnerability is triggered in an out-of-memory situation and can cause an application crash, with other impact unspecified.
What is the recommended remediation?
Update libopenmpt to version 0.3.9 or later using the available patch. The provided data does not specify an alternative mitigation if patching cannot be performed immediately.