CVE-2006-4192 Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43 and earlier and libmodplug 0.8 and earlier, as used in GStreamer and possibly other products, allow user-assisted remote attackers to....
MediumCVSS 5.1
EPSS 9.0%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43 and earlier and libmodplug 0.8 and earlier, as used in GStreamer and possibly other products, allow user-assisted remote attackers to execute arbitrary code via (1) long strings in ITP files used by the CSoundFile::ReadITProject function in soundlib/Load_it.cpp and (2) crafted modules used by the CSoundFile::ReadSample function in soundlib/Sndfile.cpp, as demonstrated by crafted AMF files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| modplug tracker | <= 1.17.02.43 | No fix listed |
| debian/libmodplug(Debian:12) | < 1:0.7-5.2 | 1:0.7-5.2 |
| debian/libmodplug(Debian:13) | < 1:0.7-5.2 | 1:0.7-5.2 |
| debian/libmodplug(Debian:14) | < 1:0.7-5.2 | 1:0.7-5.2 |
References
- aluigi.altervista.org
- cgit.freedesktop.org
- 21418 third-party-advisory vendor-advisory
- 22080 third-party-advisory
- 22658 third-party-advisory
- 23294 third-party-advisory
- 23555 third-party-advisory
- 26979 third-party-advisory
- GLSA-200612-04 vendor-advisory
- 1397 third-party-advisory
- MDKSA-2007:001 vendor-advisory
- SUSE-SR:2006:023 vendor-advisory
- 20060809 Stack and heap overflows in MODPlug Tracker/OpenMPT 1.17.02.43 and libmodplug 0.8 mailing-list
- 19448 vdb-entry
- USN-521-1 vendor-advisory
- ADV-2006-3231 vdb-entry
- ADV-2006-4310 vdb-entry
- bugzilla.redhat.com
- openmpt-loadit-bo(28305) vdb-entry
- openmpt-readsample-bo(28309) vdb-entry
- RHSA-2011:0477 vendor-advisory
- Debian Security Tracker CVE-2006-4192 vendor-advisory
- bugs.debian.org issue-tracking