PatchTheCVEopenmpt vulnerabilities
Recent CVEs affecting openmpt products. 10 tracked.
openmpt has 10 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 10. Most recent: 2019-10-04. Highest priority: CVE-2019-17113 (score 61/100).
- CVE-2019-17113 CRITICAL 9.8 UPGRADE In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmp
- CVE-2019-14383 MEDIUM 6.5 UPGRADE MITIGATE J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
- CVE-2019-14382 MEDIUM 6.5 UPGRADE DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
- CVE-2019-14381 HIGH 7.5 UPGRADE libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL i
- CVE-2019-14380 MEDIUM 6.5 UPGRADE MITIGATE libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.
- CVE-2018-6611 HIGH 8.8 UPGRADE UPGRADE soundlib/Load_stp.cpp in OpenMPT through 1.27.04.00, and libopenmpt before 0.3.6, has an out-of-bounds read vi
- CVE-2018-20861 MEDIUM 6.5 UPGRADE libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.
- CVE-2018-20860 MEDIUM 6.5 UPGRADE MITIGATE libopenmpt before 0.3.13 allows a crash with malformed MED files.
- CVE-2018-11710 HIGH 8.8 UPGRADE soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (applicatio
- CVE-2018-10017 MEDIUM 6.5 UPGRADE UPGRADE soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause
FAQ
How do I fix openmpt vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is openmpt being exploited right now?
None of the tracked openmpt CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which openmpt CVE should I patch first?
CVE-2019-17113 currently ranks highest (61/100): In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmp.