National Cyber Awareness System

Vulnerability Summary for CVE-2011-2913

Overview

Off-by-one error in the CSoundFile::ReadAMS function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (stack memory corruption) and possibly execute arbitrary code via a crafted AMS file with a large number of samples.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: libmodplug-ams-code-execution(68985)

Hyperlink:http://xforce.iss.net/xforce/xfdb/68985

External Source: BID

Name: 48979

Hyperlink:http://www.securityfocus.com/bid/48979

External Source: OSVDB

Name: 74210

Hyperlink:http://www.osvdb.org/74210

External Source: MLIST

Name: [oss-security] 20120812 Re: CVE request: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3

Hyperlink:http://www.openwall.com/lists/oss-security/2011/08/12/4

External Source: MLIST

Name: [oss-security] 20120810 CVE request: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3

Hyperlink:http://www.openwall.com/lists/oss-security/2011/08/10/4

External Source: GENTOO

Name: GLSA-201203-16

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-201203-16.xml

External Source: GENTOO

Name: GLSA-201203-14

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-201203-14.xml

External Source: DEBIAN

Name: DSA-2415

Hyperlink:http://www.debian.org/security/2012/dsa-2415

External Source: UBUNTU

Name: USN-1255-1

Hyperlink:http://ubuntu.com/usn/usn-1255-1

External Source: CONFIRM

Name: http://sourceforge.net/projects/modplug-xmms/files/libmodplug/0.8.8.4/

Hyperlink:http://sourceforge.net/projects/modplug-xmms/files/libmodplug/0.8.8.4/

External Source: SECUNIA

Name: 48439

Type: Advisory

Hyperlink:http://secunia.com/advisories/48439

External Source: SECUNIA

Name: 48434

Type: Advisory

Hyperlink:http://secunia.com/advisories/48434

External Source: SECUNIA

Name: 48058

Type: Advisory

Hyperlink:http://secunia.com/advisories/48058

External Source: SECUNIA

Name: 46793

Type: Advisory

Hyperlink:http://secunia.com/advisories/46793

External Source: SECUNIA

Name: 46043

Type: Advisory

Hyperlink:http://secunia.com/advisories/46043

External Source: SECUNIA

Name: 46032

Type: Advisory

Hyperlink:http://secunia.com/advisories/46032

External Source: SECUNIA

Name: 45901

Type: Advisory

Hyperlink:http://secunia.com/advisories/45901

External Source: SECUNIA

Name: 45742

Type: Advisory

Hyperlink:http://secunia.com/advisories/45742

External Source: SECUNIA

Name: 45658

Type: Advisory

Hyperlink:http://secunia.com/advisories/45658

External Source: SECUNIA

Name: 45131

Type: Advisory

Hyperlink:http://secunia.com/advisories/45131

External Source: REDHAT

Name: RHSA-2011:1264

Hyperlink:http://rhn.redhat.com/errata/RHSA-2011-1264.html

External Source: CONFIRM

Name: http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=26243ab9fe1171f70053e9aec4b20e9f7de9e4ef

Hyperlink:http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=26243ab9fe1171f70053e9aec4b20e9f7de9e4ef

External Source: SUSE

Name: openSUSE-SU-2011:0943

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00019.html

External Source: FEDORA

Name: FEDORA-2011-12370

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066044.html

External Source: FEDORA

Name: FEDORA-2011-10503

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063786.html

External Source: CONFIRM

Name: http://jira.atheme.org/browse/AUDPLUG-394

Hyperlink:http://jira.atheme.org/browse/AUDPLUG-394