[SECURITY] [DSA 2415-1] libmodplug security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2415-1 security@xxxxxxxxxx
http://www.debian.org/security/ Nico Golde
February 21, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libmodplug
Vulnerability : several
Problem type : local
Debian-specific: no
CVE ID : CVE-2011-1761 CVE-2011-2911 CVE-2011-2912 CVE-2011-2913
CVE-2011-2914 CVE-2011-2915

Several vulnerabilities that can lead to the execution of arbitrary code
have been discovered in libmodplug, a library for mod music based on
ModPlug. The Common Vulnerabilities and Exposures project identifies
the following issues:

CVE-2011-1761

epiphant discovered that the abc file parser is vulnerable to several
stack-based buffer overflows that potentially lead to the execution
of arbitrary code.

CVE-2011-2911

Hossein Lotfi of Secunia discovered that the CSoundFile::ReadWav
function is vulnerable to an integer overflow which leads to a
heap-based buffer overflow. An attacker can exploit this flaw to
potentially execute arbitrary code by tricking a victim into opening
crafted WAV files.

CVE-2011-2912

Hossein Lotfi of Secunia discovered that the CSoundFile::ReadS3M
function is vulnerable to a stack-based buffer overflow. An attacker
can exploit this flaw to potentially execute arbitrary code by
tricking a victim into opening crafted S3M files.

CVE-2011-2913

Hossein Lotfi of Secunia discovered that the CSoundFile::ReadAMS
function suffers from an off-by-one vulnerability that leads to
memory corruption. An attacker can exploit this flaw to potentially
execute arbitrary code by tricking a victim into opening crafted AMS
files.

CVE-2011-2914

It was discovered that the CSoundFile::ReadDSM function suffers
from an off-by-one vulnerability that leads to memory corruption.
An attacker can exploit this flaw to potentially execute arbitrary
code by tricking a victim into opening crafted DSM files.

CVE-2011-2915

It was discovered that the CSoundFile::ReadAMS2 function suffers
from an off-by-one vulnerability that leads to memory corruption.
An attacker can exploit this flaw to potentially execute arbitrary
code by tricking a victim into opening crafted AMS files.


For the stable distribution (squeeze), this problem has been fixed in
version 1:0.8.8.1-1+squeeze2.

For the testing (wheezy) and unstable (sid) distributions, this problem
has been fixed in version 1:0.8.8.4-1.

We recommend that you upgrade your libmodplug packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk9ELRcACgkQHYflSXNkfP+KngCffkP46LcmaSlOTCaIB5JoTyXs
7z0AoK4EaUFB9Qelksy9oqBeZ4f8ys7d
=5vLD
-----END PGP SIGNATURE-----



Relevant Pages

  • [Full-disclosure] [SECURITY] [DSA 2415-1] libmodplug security update
    ... Several vulnerabilities that can lead to the execution of arbitrary code ... tricking a victim into opening crafted S3M files. ... function suffers from an off-by-one vulnerability that leads to ...
    (Full-Disclosure)
  • [ GLSA 200407-11 ] wv: Buffer overflow vulnerability
    ... A buffer overflow vulnerability exists in the wv library that can allow ... an attacker to execute arbitrary code with the privileges of the user ... trigger the vulnerable code and execute it's own arbitrary code. ... Security is a primary focus of Gentoo Linux and ensuring the ...
    (Bugtraq)
  • [Full-Disclosure] [ GLSA 200407-11 ] wv: Buffer overflow vulnerability
    ... A buffer overflow vulnerability exists in the wv library that can allow ... an attacker to execute arbitrary code with the privileges of the user ... trigger the vulnerable code and execute it's own arbitrary code. ... Security is a primary focus of Gentoo Linux and ensuring the ...
    (Full-Disclosure)
  • [ GLSA 200407-11 ] wv: Buffer overflow vulnerability
    ... A buffer overflow vulnerability exists in the wv library that can allow ... an attacker to execute arbitrary code with the privileges of the user ... trigger the vulnerable code and execute it's own arbitrary code. ... Security is a primary focus of Gentoo Linux and ensuring the ...
    (Full-Disclosure)
  • [Full-disclosure] [SECURITY] [DSA 2297-1] icedove security update
    ... version of the Thunderbird mail/news client. ... "regenrecht" discovered that incorrect pointer handling in the SVG ... processing code could lead to the execution of arbitrary code. ... vulnerability in the event handler code. ...
    (Full-Disclosure)