CVE-2011-2912

Publication date 6 October 2011

Last updated 24 July 2024

Ubuntu priority

Stack-based buffer overflow in the CSoundFile::ReadS3M function in src/load_s3m.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted S3M file with an invalid offset.

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
gst-plugins-bad0.10	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	8.04 LTS hardy	Ignored end of life
libmodplug	11.10 oneiric	Fixed 1:0.8.8.2-3ubuntu1.1
	11.04 natty	Fixed 1:0.8.8.1-2ubuntu0.3
	10.10 maverick	Fixed 1:0.8.8.1-1ubuntu1.3
	10.04 LTS lucid	Fixed 1:0.8.7-1ubuntu0.3
	8.04 LTS hardy	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libmodplug	Upstream: http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=f4e5295658fff000379caa122e75c9200205fe20

References

Related Ubuntu Security Notices (USN)

USN-1255-1
libmodplug vulnerabilities
9 November 2011

CVE-2011-2912

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references