CVE-2013-4233 Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted....
MediumCVSS 6.8
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted P header in an ABC file, which triggers a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libmodplug(Debian:12) | < 1:0.8.8.4-4 | 1:0.8.8.4-4 |
| debian/libmodplug(Debian:13) | < 1:0.8.8.4-4 | 1:0.8.8.4-4 |
| debian/libmodplug(Debian:14) | < 1:0.8.8.4-4 | 1:0.8.8.4-4 |
| konstanty bialkowski libmodplug | <= 0.8.8.4 | No fix listed |
| konstanty bialkowski libmodplug | = 0.8 | No fix listed |
| konstanty bialkowski libmodplug | = 0.8.4 | No fix listed |
| konstanty bialkowski libmodplug | = 0.8.5 | No fix listed |
| konstanty bialkowski libmodplug | = 0.8.6 | No fix listed |
| konstanty bialkowski libmodplug | = 0.8.7 | No fix listed |
| konstanty bialkowski libmodplug | = 0.8.8 | No fix listed |
| konstanty bialkowski libmodplug | = 0.8.8.1 | No fix listed |
| konstanty bialkowski libmodplug | = 0.8.8.2 | No fix listed |
| konstanty bialkowski libmodplug | = 0.8.8.3 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2013-4233 vendor-advisory
- blog.scrt.ch exploit
- 54388 third-party-advisory vendor-advisory
- 54695 third-party-advisory vendor-advisory
- DSA-2751 vendor-advisory
- [oss-security] 20130809 Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow exploit mailing-list
- bugs.debian.org issue-tracking