CVE-2018-11710: High severity libopenmpt0 vulnerability

Q: Who is exposed to this vulnerability?

Systems using libopenmpt versions before 0.3.9 are affected when they process a crafted AMS file. The issue is remotely reachable and does not require attacker privileges, but user interaction is required.

Q: What does an attacker need to exploit it?

An attacker needs to provide a specially crafted AMS file that is processed by the vulnerable library. The vulnerability is triggered in an out-of-memory situation and can cause an application crash, with other impact unspecified.

Q: What is the recommended remediation?

Update libopenmpt to version 0.3.9 or later using the available patch. The provided data does not specify an alternative mitigation if patching cannot be performed immediately.

Published Jun 4, 2018

Updated

soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted AMS file because of an invalid write near address 0 in an out-of-memory situation.

Affected Software

1 affected component

libopenmpt0<0.3.9

Remediation

Patch Available

https://lib.openmpt.org/libopenmpt/2018/04/29/security-updates-0.3.9-0.2-beta32-0.2.7561-beta20.5-p9-0.2.7386-beta20.3-p12/

Event History

Jun 4, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

Description

Frequently Asked Questions

Who is exposed to this vulnerability?

Systems using libopenmpt versions before 0.3.9 are affected when they process a crafted AMS file. The issue is remotely reachable and does not require attacker privileges, but user interaction is required.

What does an attacker need to exploit it?

An attacker needs to provide a specially crafted AMS file that is processed by the vulnerable library. The vulnerability is triggered in an out-of-memory situation and can cause an application crash, with other impact unspecified.

What is the recommended remediation?

Update libopenmpt to version 0.3.9 or later using the available patch. The provided data does not specify an alternative mitigation if patching cannot be performed immediately.

CVE-2018-11710: High severity libopenmpt0 vulnerability

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

What is the recommended remediation?