CVE-2018-6611: High severity libopenmpt0 vulnerability

Q: Which deployments are exposed?

Systems using OpenMPT through 1.27.04.00 or libopenmpt before 0.3.6 are affected when they process an STP file. The issue is reachable over the network only if an application exposes or receives attacker-supplied STP content.

Q: What does an attacker need to exploit this issue?

An attacker needs to provide a malformed STP file and have a user or application process it. No attacker privileges are required, but user interaction is required according to the CVSS vector.

Q: What is the recommended remediation?

Apply the available patch by updating beyond the affected OpenMPT and libopenmpt versions. The provided remediation information does not specify a workaround for environments that cannot patch immediately.

Published Feb 4, 2018

Updated

soundlib/Loadstp.cpp in OpenMPT through 1.27.04.00, and libopenmpt before 0.3.6, has an out-of-bounds read via a malformed STP file.

Affected Software

2 affected components

libopenmpt0<0.3.6

OpenMPT OpenMPT<=1.27.04.00

Remediation

Patch Available

https://github.com/OpenMPT/openmpt/commit/b60b322cf9f0ffa624018f1bb9783edf0dc908c3

Patch Available

https://lib.openmpt.org/libopenmpt/2018/02/03/security-update-0.3.6/

Event History

Feb 4, 2018

CVE Published

via MITRE·12:00 PM

Data Sourced

via MITRE·12:00 PM

Description

Data Sourced

via NVD·12:29 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed?

Systems using OpenMPT through 1.27.04.00 or libopenmpt before 0.3.6 are affected when they process an STP file. The issue is reachable over the network only if an application exposes or receives attacker-supplied STP content.

What does an attacker need to exploit this issue?

An attacker needs to provide a malformed STP file and have a user or application process it. No attacker privileges are required, but user interaction is required according to the CVSS vector.

What is the recommended remediation?

Apply the available patch by updating beyond the affected OpenMPT and libopenmpt versions. The provided remediation information does not specify a workaround for environments that cannot patch immediately.

CVE-2018-6611: High severity libopenmpt0 vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the recommended remediation?