In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8206-1 advisory.

    Antonio Morales Maldonado discovered that OpenMPT did not properly limit the length of strings in certain     cases, leading to a buffer overflow. An attacker could possibly use this issue to cause OpenMPT to crash,     resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in     libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading     to a buffer overflow. (CVE-2019-17113)

Note that Nessus relies on the presence of the package as reported by the vendor.

In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.

For Debian 9 stretch, this problem has been fixed in version 0.2.7386~beta20.3-3+deb9u4.

We recommend that you upgrade your libopenmpt packages.

For the detailed security status of libopenmpt please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libopenmpt

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security issues were found in libopenmpt, a cross-platform C++ and C library to decode tracked music files, which could result in denial of service and potentially the execution of arbitrary code if malformed music files are processed.

This update for libopenmpt to version 0.3.19 fixes the following issues :

  - CVE-2019-17113: Fixed a buffer overflow in     ModPlug_InstrumentName and ModPlug_SampleName     (bsc#1153102).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libopenmpt to version 0.3.19 fixes the following issues :

CVE-2019-17113: Fixed a buffer overflow in ModPlug_InstrumentName and ModPlug_SampleName (bsc#1153102).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
310141	Ubuntu 18.04 LTS : OpenMPT vulnerability (USN-8206-1)	Nessus	Ubuntu Local Security Checks	Local	critical
256092	Linux Distros Unpatched Vulnerability : CVE-2019-17113	Nessus	Misc.	Local	critical
139251	Debian DLA-2308-1 : libopenmpt security update	Nessus	Debian Local Security Checks	Local	critical
138649	Debian DSA-4729-1 : libopenmpt - security update	Nessus	Debian Local Security Checks	Local	critical
130000	openSUSE Security Update : libopenmpt (openSUSE-2019-2319)	Nessus	SuSE Local Security Checks	Local	critical
129805	openSUSE Security Update : libopenmpt (openSUSE-2019-2306)	Nessus	SuSE Local Security Checks	Local	critical
129773	SUSE SLED15 / SLES15 Security Update : libopenmpt (SUSE-SU-2019:2622-1)	Nessus	SuSE Local Security Checks	Local	critical

Detections

Analytics

CVE-2019-17113

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical