CVE-2007-6720 libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playb...
MediumCVSS 4.3
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playback calculations, which allows user-assisted attackers to cause a denial of service (application crash) by loading multiple songs (aka MOD files) with different numbers of channels.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| igno saitz libmikmod | = 3.1.9-1 | No fix listed |
| igno saitz libmikmod | = 3.1.9-2 | No fix listed |
| igno saitz libmikmod | = 3.1.9-3 | No fix listed |
| igno saitz libmikmod | = 3.1.9-4 | No fix listed |
| igno saitz libmikmod | = 3.1.9-5 | No fix listed |
| igno saitz libmikmod | = 3.1.9-6 | No fix listed |
| igno saitz libmikmod | = 3.1.10-1 | No fix listed |
| igno saitz libmikmod | = 3.1.10-2 | No fix listed |
| igno saitz libmikmod | = 3.1.10-3 | No fix listed |
| igno saitz libmikmod | = 3.1.10-4 | No fix listed |
| igno saitz libmikmod | = 3.1.10-5 | No fix listed |
| igno saitz libmikmod | = 3.1.11-1 | No fix listed |
| igno saitz libmikmod | = 3.1.11-2 | No fix listed |
| igno saitz libmikmod | = 3.1.11-3 | No fix listed |
| igno saitz libmikmod | = 3.1.11-4 | No fix listed |
| igno saitz libmikmod | = 3.1.11-5 | No fix listed |
| igno saitz libmikmod | = 3.1.11-6 | No fix listed |
| igno saitz libmikmod | = 3.1.12 | No fix listed |
| igno saitz libmikmod | = 3.2.0 | No fix listed |
| debian/libmikmod(Debian:12) | < 3.1.11-6.1 | 3.1.11-6.1 |
| debian/libmikmod(Debian:13) | < 3.1.11-6.1 | 3.1.11-6.1 |
| debian/libmikmod(Debian:14) | < 3.1.11-6.1 | 3.1.11-6.1 |
| debian/sdl-mixer1.2(Debian:12) | < 1.2.8-1 | 1.2.8-1 |
| debian/sdl-mixer1.2(Debian:13) | < 1.2.8-1 | 1.2.8-1 |
| debian/sdl-mixer1.2(Debian:14) | < 1.2.8-1 | 1.2.8-1 |
References
- bugs.debian.org
- bugs.debian.org
- SUSE-SR:2009:006 vendor-advisory
- [oss-security] 20090113 CVE Request -- libmikmod mailing-list
- 34259 third-party-advisory
- www.oracle.com
- 33235 vdb-entry
- bugzilla.redhat.com
- FEDORA-2009-9095 vendor-advisory
- FEDORA-2009-9112 vendor-advisory
- Debian Security Tracker CVE-2007-6720 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking