debian/libopenmpt vulnerabilities

Latest debian/libopenmpt CVEs

Newest publication first

1. DLA-2308-1 libopenmpt - security update

   Published 2020-08-02

   Unknown

2. DSA-4729-1 libopenmpt - security update

   Published 2020-07-19

   Unknown

3. CVE-2019-17113 In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API,....

   Published 2019-10-03

   Critical·CVSS 9.8 EPSS 2.8%

   In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.

4. CVE-2019-14380 libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.

   Published 2019-07-30

   Medium·CVSS 6.5 EPSS 0.94%

   libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.

5. CVE-2019-14382 DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.

   Published 2019-07-30

   Medium·CVSS 6.5 EPSS 1.2%

   DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.

6. CVE-2019-14383 J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.

   Published 2019-07-30

   Medium·CVSS 6.5 EPSS 1.3%

   J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.

7. CVE-2018-20860 libopenmpt before 0.3.13 allows a crash with malformed MED files.

   Published 2019-07-30

   Medium·CVSS 6.5 EPSS 1.3%

   libopenmpt before 0.3.13 allows a crash with malformed MED files.

8. CVE-2018-20861 libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.

   Published 2019-07-30

   Medium·CVSS 6.5 EPSS 1.1%

   libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.

9. CVE-2019-14381 libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot.

   Published 2019-07-30

   High·CVSS 7.5 EPSS 1.4%

   libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot.

10. CVE-2018-11710 soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted AMS file because of an in...

    Published 2018-06-04

    High·CVSS 8.8 EPSS 1.8%

    soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted AMS file because of an invalid write near address 0 in an out-of-memory situation.

11. CVE-2018-10017 soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern lo...

    Published 2018-04-11

    Medium·CVSS 6.5 EPSS 1.9%

    soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern loops.

12. CVE-2018-6611 soundlib/Load_stp.cpp in OpenMPT through 1.27.04.00, and libopenmpt before 0.3.6, has an out-of-bounds read via a malformed STP file.

    Published 2018-02-04

    High·CVSS 8.8 EPSS 1.3%

    soundlib/Load_stp.cpp in OpenMPT through 1.27.04.00, and libopenmpt before 0.3.6, has an out-of-bounds read via a malformed STP file.

13. CVE-2017-11311 soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential for arbitrary code execution via a crafted PSM File that trigger...

    Published 2017-07-13

    High·CVSS 7.8 EPSS 1.7%

    soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential for arbitrary code execution via a crafted PSM File that triggers use of the same sample slot for two samples.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.