Integer overflow in the abcsetparts function in loadabc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted P header in an ABC file, which triggers a heap-based buffer overflow.

Multiple heap-based buffer overflows in the (1) abcMIDIdrum and (2) abcMIDIgchord functions in loadabc.cpp in libmodplug 0.8.8.4 and earlier allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted ABC.

Multiple stack-based buffer overflows in the (1) abcnewmacro and (2) abcnewumacro functions in src/loadabc.cpp in libmodplug before 0.8.8.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ABC file. NOTE: some of these details are obtained from third party information.

Stack-based buffer overflow in the CSoundFile::ReadS3M function in src/loads3m.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted S3M file with an invalid offset.

Off-by-one error in the CSoundFile::ReadAMS2 function in src/loadams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted AMS file with a large number of instruments.

Off-by-one error in the CSoundFile::ReadDSM function in src/loaddms.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted DSM file with a large number of samples.

Integer overflow in the CSoundFile::ReadWav function in src/loadwav.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted WAV file, which triggers a heap-based buffer overflow.

Off-by-one error in the CSoundFile::ReadAMS function in src/loadams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (stack memory corruption) and possibly execute arbitrary code via a crafted AMS file with a large number of samples.

A stack-based buffer overflow vulnerability was discovered [1] in the way that that libmodplug handled S3M media files. If an attacker were able to coerce a user into opening a malicious S3M media file with an application linked to libmodplug, it could be possible to execute arbitrary code with the privileges of the user running the application.

This has been corrected upstream [2] in 0.8.8.2

[1] https://www.sec-consult.com/files/20110407-0libmodplugstackoverflow.txt [2] http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=aecef259828a89bb00c2e6f78e89de7363b2237b

Buffer overflow in the PATinst function in src/loadpat.cpp in libmodplug before 0.8.7 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a long instrument name.

An integer overflow flaw was found in the Amiga MED/OctaMED tracker module sound file (MED) loading routine used by the Modplug mod music file format library (libmodplug). An attacker could create a malicious MED file, that could cause an application utilizing the libmodplug library to crash, when opened by the victim.

References: http://bugs.gentoo.org/showbug.cgi?id=266913 http://www.securityfocus.com/bid/30801/info http://sourceforge.net/project/shownotes.php?releaseid=677065&groupid=1275

Modplug-xmms/libmodplug patch (fixing the vulnerability): http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/loadmed.cpp?r1=1.1&r2=1.2