CVE-2019-14380: Medium severity libopenmpt0 vulnerability
Published Jul 30, 2019
·Updated
libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.
Affected Software
3 affected componentsFixes available
debian/libopenmpt
0.4.3-1+deb10u10.4.11-10.6.9-10.7.3-1
OpenMPT libopenmpt<0.4.5
Debian Debian Linux=10.0
Remediation
Event History
Jul 30, 2019
CVE Published
via MITRE·06:35 PM
Data Sourced
via MITRE·06:35 PM
Description
Frequently Asked Questions
1
What conditions are required to trigger the crash?
Systems using libopenmpt versions before 0.4.5 are affected when they play specially crafted XM or MT2 files. The issue can be triggered remotely only if an attacker can get a user or application to process a malicious file.
2
What should I do to remediate this issue?
A patch is available. Update libopenmpt to version 0.4.5 or a vendor-provided fixed package for the affected Debian system.