CVE-2018-20860: Input Validation
Published Jul 30, 2019
·Updated
libopenmpt before 0.3.13 allows a crash with malformed MED files.
Affected Software
3 affected components
OpenMPT libopenmpt<0.3.13
openSUSE Leap=15.0
openSUSE Leap=15.1
Remediation
Event History
Jul 30, 2019
CVE Published
via MITRE·06:33 PM
Data Sourced
via MITRE·06:33 PM
Description
Frequently Asked Questions
1
Which deployments are exposed?
Systems using libopenmpt versions before 0.3.13 are affected when they process malformed MED files. The listed software includes openSUSE Leap and OpenMPT libopenmpt.
2
What does an attacker need to exploit this issue?
An attacker needs to supply or persuade a user to open a malformed MED file. No authentication or prior privileges are required, but user interaction is required.
3
What is the practical impact?
Successful exploitation can crash the affected application or component, causing a denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.
4
What should be done to remediate the vulnerability?
Apply the available patch by updating libopenmpt to a version that is not before 0.3.13.