https://github.com/adplug/adplug/issues/91

FEDORA-2021-24ef21134b

FEDORA-2021-64168929e4

AdPlug 2.3.3 ============

  - New RAD player replacing the old one

  - Bug fixes: (huge thanks to Alexander Miller for these)

  - CVE-2019-14690 - buffer overflow in `.bmf`

  - CVE-2019-14691 - buffer overflow in `.dtm`

  - CVE-2019-14692 - buffer overflow in `.mkj`

  - CVE-2019-14732 - buffer overflow in `.a2m`

  - CVE-2019-14733 - buffer overflow in `.rad`

  - CVE-2019-14734 - buffer overflow in `.mtk`

  - CVE-2019-15151 - double free and OOB reads in `.u6m`

  - OOB reads in `.xad`

  - OOB reads in `.rix`

AdPlug 2.3.2 ============

  - Bug fixes :

  - FMOPL: Fix global variable pointer double-free     (CVE-2018-17825)

  - HERAD: Fix compilation on GCC 4.2.1

  - ADL: Calling `rewind()` before `update()` causes access     violation

  - Move OPL reset/init code to `rewind()` for some players

AdPlug 2.3.1 ============

  - Fixed unconditional inclusion of 'sys/io.h' on Linux

  - Autotools improvement

  - Non-recursive Automake, improved parallelizability

  - Compatibility fixes for FreeBSD's pmake and OpenBSD's     make

  - Out-of-source building

AdPlug 2.3 ==========

  - Bug fixes :

  - CMF: Fix uninitialised variable use (thanks     binarymaster)

  - CMF: Handle invalid offsets without crashing

  - ROL: Prevent access beyond end of vector

  - MSC: Fix use of uninitialised variable

  - HSC: Handle out of range patterns more gracefully

  - MID: Fix out of range array read

  - LDS: Use the tempo stored inside the Loudness-File     instead of simply returning 70Hz

  - RIX: Fix several replay bugs (thanks to Palxex)

  - RIX: Big-endian fix by Wei Mingzhi

  - XAD: Tempo fix

  - Various other out of bounds array fixes, timing fixes,     etc.

  - New formats :

  - BMF: Easy AdLib 1.0

  - CMF: SoundFX Macs Opera

  - GOT: God of Thunder

  - HSQ/SQX/SDB/AGD/HA2: Herbulot AdLib System (HERAD)

  - MUS/IMS/MDI: AdLib Visual Composer ROL derivatives

  - SOP: sopepos' Note Player

  - VGM: Video Game Music

  - Allow compilation on platforms that don't support real     OPL hardware access

  - Add support for compiling on Appveyor and publishing a     NuGet package

  - Add Visual Studio 2015 projects

  - Add support for Travis CI builds

  - Add new CRC16 and CRC32 tests

  - Addition of WoodyOPL from DOSBox SVN (thanks to NY00123)

  - Addition of NukedOPL (thanks to loki666 and nukeykt)

  - Move from SourceForge to GitHub

  - DRO player refactored (thanks to Laurence Myers and     William Yates)

  - Add (mono) OPL3 support to the surround/harmonic-effect     OPL

  - Fix occasional random noise in right channel when using     surround OPL and Satoh synth

  - Add display for ROL comment and instrument names

  - Improve support for different Westwood ADL format     versions

  - Improve CMF transpose support (per-channel now)

  - Autotools build environment updated

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Malvineous on Github reports :

This release fixes the following security issues :

- buffer overflow in .bmf

- buffer overflow in .dtm

- buffer overflow in .mkj

- buffer overflow in .a2m

- buffer overflow in .rad

- buffer overflow in .mtk

- double free and OOB reads in .u6m

ID	Name	Product	Family	Severity
144965	Fedora 32 : adplug / audacious-plugins / ocp (2021-24ef21134b)	Nessus	Fedora Local Security Checks	high
144964	Fedora 33 : adplug / audacious-plugins / ocp (2021-64168929e4)	Nessus	Fedora Local Security Checks	high
137344	FreeBSD : libadplug -- Various vulnerabilities (329ecd60-aaf7-11ea-8659-10bf48e1088e)	Nessus	FreeBSD Local Security Checks	high

CVE-2019-15151

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Tenable Plugins