PatchTheCVElibopenmpt vulnerabilities and fixes
Recent CVEs affecting libopenmpt, with upgrade or downgrade steps. 11 tracked.
libopenmpt has 11 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 11. Most recent: 2019-10-04. Highest priority: CVE-2019-17113 (score 61/100).
- CVE-2019-17113 CRITICAL 9.8 UPGRADE In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmp
- CVE-2019-14383 MEDIUM 6.5 UPGRADE MITIGATE J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
- CVE-2019-14382 MEDIUM 6.5 UPGRADE DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
- CVE-2019-14381 HIGH 7.5 UPGRADE libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL i
- CVE-2019-14380 MEDIUM 6.5 UPGRADE MITIGATE libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.
- CVE-2018-6611 HIGH 8.8 UPGRADE UPGRADE soundlib/Load_stp.cpp in OpenMPT through 1.27.04.00, and libopenmpt before 0.3.6, has an out-of-bounds read vi
- CVE-2018-20861 MEDIUM 6.5 UPGRADE libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.
- CVE-2018-20860 MEDIUM 6.5 UPGRADE MITIGATE libopenmpt before 0.3.13 allows a crash with malformed MED files.
- CVE-2018-11710 HIGH 8.8 UPGRADE soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (applicatio
- CVE-2018-10017 MEDIUM 6.5 UPGRADE UPGRADE soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause
- CVE-2017-11311 HIGH 7.8 UPGRADE UPGRADE soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer ov
FAQ
How do I fix libopenmpt vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libopenmpt being exploited right now?
None of the tracked libopenmpt CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libopenmpt CVE should I patch first?
CVE-2019-17113 currently ranks highest (61/100): In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmp.