CVE-2019-14381: Null Pointer Dereference

Q: Who is realistically exposed to this vulnerability?

Systems that process attacker-controlled module files with affected libopenmpt versions are exposed to a remote denial of service. The CVSS vector indicates exploitation requires no privileges or user interaction and can be performed over a network.

Q: What input is required to trigger the crash?

An attacker needs to cause affected libopenmpt to process a module containing a portamento from an OPL instrument to an empty instrument note-map slot. Successful exploitation crashes the process through a NULL pointer dereference; the stated impact is availability only.

Q: What version resolves the issue?

Update libopenmpt to version 0.4.3 or later, since versions before 0.4.3 are identified as affected.

Published Jul 30, 2019

Updated

libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot.

Affected Software

1 affected component

libopenmpt0<0.4.3

Event History

Jul 30, 2019

CVE Published

via MITRE·12:41 PM

Data Sourced

via MITRE·12:41 PM

Description

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

Systems that process attacker-controlled module files with affected libopenmpt versions are exposed to a remote denial of service. The CVSS vector indicates exploitation requires no privileges or user interaction and can be performed over a network.

What input is required to trigger the crash?

An attacker needs to cause affected libopenmpt to process a module containing a portamento from an OPL instrument to an empty instrument note-map slot. Successful exploitation crashes the process through a NULL pointer dereference; the stated impact is availability only.

What version resolves the issue?

Update libopenmpt to version 0.4.3 or later, since versions before 0.4.3 are identified as affected.

CVE-2019-14381: Null Pointer Dereference

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

What input is required to trigger the crash?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

What input is required to trigger the crash?

What version resolves the issue?