In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in     libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading     to a buffer overflow. (CVE-2019-17113)

Note that Nessus relies on the presence of the package as reported by the vendor.

In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.

For Debian 9 stretch, this problem has been fixed in version 0.2.7386~beta20.3-3+deb9u4.

We recommend that you upgrade your libopenmpt packages.

For the detailed security status of libopenmpt please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libopenmpt

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security issues were found in libopenmpt, a cross-platform C++ and C library to decode tracked music files, which could result in denial of service and potentially the execution of arbitrary code if malformed music files are processed.

This update for libopenmpt to version 0.3.19 fixes the following issues :

  - CVE-2019-17113: Fixed a buffer overflow in     ModPlug_InstrumentName and ModPlug_SampleName     (bsc#1153102).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libopenmpt to version 0.3.19 fixes the following issues :

CVE-2019-17113: Fixed a buffer overflow in ModPlug_InstrumentName and ModPlug_SampleName (bsc#1153102).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
256092	Linux Distros Unpatched Vulnerability : CVE-2019-17113	Nessus	Misc.	critical
139251	Debian DLA-2308-1 : libopenmpt security update	Nessus	Debian Local Security Checks	critical
138649	Debian DSA-4729-1 : libopenmpt - security update	Nessus	Debian Local Security Checks	critical
130000	openSUSE Security Update : libopenmpt (openSUSE-2019-2319)	Nessus	SuSE Local Security Checks	critical
129805	openSUSE Security Update : libopenmpt (openSUSE-2019-2306)	Nessus	SuSE Local Security Checks	critical
129773	SUSE SLED15 / SLES15 Security Update : libopenmpt (SUSE-SU-2019:2622-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-17113

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical