CVE-2019-17113: Buffer Overflow
In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlugInstrumentName and ModPlugSampleName in libopenmptmodplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which versions and packages are affected?
Systems using libopenmpt versions earlier than 0.3.19, or 0.4.x versions earlier than 0.4.9, are affected. The listed Debian packages are libopenmpt0 and debian/libopenmpt.
What does an attacker need to exploit this issue?
The CVSS vector indicates exploitation can be performed remotely with low attack complexity, requires no privileges or user interaction, and can result in high impact to confidentiality, integrity, and availability.
What is the remediation?
Apply the available patch or update to a fixed libopenmpt release: 0.3.19 or later in the 0.3 branch, or 0.4.9 or later in the 0.4 branch.