PatchTheCVElibmodplug vulnerabilities and fixes
Recent CVEs affecting libmodplug, with upgrade or downgrade steps. 8 tracked.
libmodplug has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2013-09-16. Highest priority: CVE-2013-4234 (score 57/100).
- CVE-2013-4234 MEDIUM 6.8 UPGRADE MITIGATE Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cp
- CVE-2013-4233 MEDIUM 6.8 UPGRADE MITIGATE Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote
- CVE-2011-2915 MEDIUM 6.8 UPGRADE Off-by-one error in the CSoundFile::ReadAMS2 function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows
- CVE-2011-2914 MEDIUM 6.8 UPGRADE Off-by-one error in the CSoundFile::ReadDSM function in src/load_dms.cpp in libmodplug before 0.8.8.4 allows r
- CVE-2011-2913 MEDIUM 6.8 UPGRADE Off-by-one error in the CSoundFile::ReadAMS function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows r
- CVE-2011-2912 MEDIUM 6.8 UPGRADE Stack-based buffer overflow in the CSoundFile::ReadS3M function in src/load_s3m.cpp in libmodplug before 0.8.8
- CVE-2011-2911 MEDIUM 6.8 UPGRADE Integer overflow in the CSoundFile::ReadWav function in src/load_wav.cpp in libmodplug before 0.8.8.4 allows r
- CVE-2011-1761 MEDIUM 6.8 UPGRADE Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro functions in src/load_ab
FAQ
How do I fix libmodplug vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libmodplug being exploited right now?
None of the tracked libmodplug CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libmodplug CVE should I patch first?
CVE-2013-4234 currently ranks highest (57/100): Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cp.