This update of libmodplug0 fixes the following issues :

1) An integer overflow error exists within the 'CSoundFile::ReadWav()' function (src/load_wav.cpp) when processing certain WAV files. This can be exploited to cause a heap-based buffer overflow by tricking a user into opening a specially crafted WAV file. (CVE-2011-2911)

2) Boundary errors within the 'CSoundFile::ReadS3M()' function (src/load_s3m.cpp) when processing S3M files can be exploited to cause stack-based buffer overflows by tricking a user into opening a specially crafted S3M file. (CVE-2011-2912)

3) An off-by-one error within the 'CSoundFile::ReadAMS()' function (src/load_ams.cpp) can be exploited to cause a stack corruption by tricking a user into opening a specially crafted AMS file.
(CVE-2011-2913)

4) An off-by-one error within the 'CSoundFile::ReadDSM()' function (src/load_dms.cpp) can be exploited to cause a memory corruption by tricking a user into opening a specially crafted DSM file.
(CVE-2011-2914)

5) An off-by-one error within the 'CSoundFile::ReadAMS2()' function (src/load_ams.cpp) can be exploited to cause a memory corruption by tricking a user into opening a specially crafted AMS file.
(CVE-2011-2915)

Also an overflow in the ABC loader was fixed. (CVE-2011-1761)

From Red Hat Security Advisory 2011:1264 :

Updated gstreamer-plugins packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The gstreamer-plugins packages contain plug-ins used by the GStreamer streaming-media framework to support a wide variety of media formats.

An integer overflow flaw, a boundary error, and multiple off-by-one flaws were found in various ModPlug music file format library (libmodplug) modules, embedded in GStreamer. An attacker could create specially crafted music files that, when played by a victim, would cause applications using GStreamer to crash or, potentially, execute arbitrary code. (CVE-2011-2911, CVE-2011-2912, CVE-2011-2913, CVE-2011-2914, CVE-2011-2915)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing the update, all applications using GStreamer (such as Rhythmbox) must be restarted for the changes to take effect.

The remote host is affected by the vulnerability described in GLSA-201203-16 (ModPlug: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been found in ModPlug:
      The ReadS3M method in load_s3m.cpp fails to validate user-supplied         information, which could cause a stack-based buffer overflow         (CVE-2011-1574).
      The 'CSoundFile::ReadWav()' function in load_wav.cpp contains an         integer overflow which could cause a heap-based buffer overflow         (CVE-2011-2911).
      The 'CSoundFile::ReadS3M()' function in load_s3m.cpp contains         multiple boundary errors which could cause a stack-based buffer         overflow (CVE-2011-2912).
      The 'CSoundFile::ReadAMS()' function in load_ams.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2913).
      The 'CSoundFile::ReadDSM()' function in load_dms.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2914).
      The 'CSoundFile::ReadAMS2()' function in load_ams.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2915).
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file, possibly resulting in execution of arbitrary code, or a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Updated gstreamer-plugins packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The gstreamer-plugins packages contain plug-ins used by the GStreamer streaming-media framework to support a wide variety of media formats.

An integer overflow flaw, a boundary error, and multiple off-by-one flaws were found in various ModPlug music file format library (libmodplug) modules, embedded in GStreamer. An attacker could create specially crafted music files that, when played by a victim, would cause applications using GStreamer to crash or, potentially, execute arbitrary code. (CVE-2011-2911, CVE-2011-2912, CVE-2011-2913, CVE-2011-2914, CVE-2011-2915)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing the update, all applications using GStreamer (such as Rhythmbox) must be restarted for the changes to take effect.

Patch to use the system's libmodplug library.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
75902	openSUSE Security Update : libmodplug (openSUSE-SU-2011:0943-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium
68345	Oracle Linux 4 : gstreamer-plugins (ELSA-2011-1264)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
58381	GLSA-201203-16 : ModPlug: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	3/19/2012	1/6/2021	medium
56111	RHEL 4 : gstreamer-plugins (RHSA-2011:1264)	Nessus	Red Hat Local Security Checks	9/7/2011	1/14/2021	medium
56126	CentOS 4 : gstreamer-plugins (CESA-2011:1264)	Nessus	CentOS Local Security Checks	9/9/2011	1/4/2021	medium
56224	Fedora 14 : audacious-plugins-2.4.5-4.fc14 (2011-12370)	Nessus	Fedora Local Security Checks	9/19/2011	1/11/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium