CVE-2018-20860: Input Validation

Q: Which deployments are exposed?

Systems using libopenmpt versions before 0.3.13 are affected when they process malformed MED files. The listed software includes openSUSE Leap and OpenMPT libopenmpt.

Q: What does an attacker need to exploit this issue?

An attacker needs to supply or persuade a user to open a malformed MED file. No authentication or prior privileges are required, but user interaction is required.

Q: What is the practical impact?

Successful exploitation can crash the affected application or component, causing a denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.

Q: What should be done to remediate the vulnerability?

Apply the available patch by updating libopenmpt to a version that is not before 0.3.13.

Published Jul 30, 2019

Updated

libopenmpt before 0.3.13 allows a crash with malformed MED files.

Affected Software

3 affected components

OpenMPT libopenmpt<0.3.13

openSUSE Leap=15.0

openSUSE Leap=15.1

Remediation

Patch Available

https://lib.openmpt.org/libopenmpt/2018/10/21/security-updates-0.3.13-0.2.10933-beta36-0.2.7561-beta20.5-p11-0.2.7386-beta20.3-p14/

Event History

Jul 30, 2019

CVE Published

via MITRE·06:33 PM

Data Sourced

via MITRE·06:33 PM

Description

Frequently Asked Questions

Which deployments are exposed?

Systems using libopenmpt versions before 0.3.13 are affected when they process malformed MED files. The listed software includes openSUSE Leap and OpenMPT libopenmpt.

What does an attacker need to exploit this issue?

An attacker needs to supply or persuade a user to open a malformed MED file. No authentication or prior privileges are required, but user interaction is required.

What is the practical impact?

Successful exploitation can crash the affected application or component, causing a denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.

What should be done to remediate the vulnerability?

Apply the available patch by updating libopenmpt to a version that is not before 0.3.13.

CVE-2018-20860: Input Validation

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact?

What should be done to remediate the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact?

What should be done to remediate the vulnerability?