CVE-2019-14383: Medium severity libopenmpt0 vulnerability

Q: Which environments should be prioritized for exposure assessment?

Systems using libopenmpt before version 0.4.2 are affected when they parse J2B files. The listed software includes openSUSE Leap and OpenMPT libopenmpt.

Q: What is required to trigger the vulnerability?

An attacker needs to cause a target to parse a crafted J2B file. No privileges are required, but user interaction is required according to the CVSS vector.

Q: What is the expected impact of exploitation?

Successful exploitation causes an assertion failure during file parsing when debug STLs are used, resulting in a denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.

Q: What should teams do to remediate or reduce risk?

Apply the available patch and update libopenmpt to version 0.4.2 or later. If patching cannot happen immediately, avoid parsing untrusted J2B files in affected environments.

Published Jul 30, 2019

Updated

J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.

Affected Software

3 affected components

OpenMPT libopenmpt<0.4.2

openSUSE Leap=15.0

openSUSE Leap=15.1

Remediation

Patch Available

https://lib.openmpt.org/libopenmpt/2019/01/22/security-updates-0.4.2-0.3.15-0.2.11253-beta37-0.2.7561-beta20.5-p13-0.2.7386-beta20.3-p16/

Event History

Jul 30, 2019

CVE Published

via MITRE·06:33 PM

Data Sourced

via MITRE·06:33 PM

Description

Frequently Asked Questions

Which environments should be prioritized for exposure assessment?

Systems using libopenmpt before version 0.4.2 are affected when they parse J2B files. The listed software includes openSUSE Leap and OpenMPT libopenmpt.

What is required to trigger the vulnerability?

An attacker needs to cause a target to parse a crafted J2B file. No privileges are required, but user interaction is required according to the CVSS vector.

What is the expected impact of exploitation?

Successful exploitation causes an assertion failure during file parsing when debug STLs are used, resulting in a denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.

What should teams do to remediate or reduce risk?

Apply the available patch and update libopenmpt to version 0.4.2 or later. If patching cannot happen immediately, avoid parsing untrusted J2B files in affected environments.

CVE-2019-14383: Medium severity libopenmpt0 vulnerability

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Which environments should be prioritized for exposure assessment?

What is required to trigger the vulnerability?

What is the expected impact of exploitation?

What should teams do to remediate or reduce risk?

Company

Resources

Contact

Frequently Asked Questions

Which environments should be prioritized for exposure assessment?

What is required to trigger the vulnerability?

What is the expected impact of exploitation?

What should teams do to remediate or reduce risk?