oss-security - Re: CVE Request -- libmodplug

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1240846586.13326.12.camel@dhcp-lab-164.englab.brq.redhat.com>
Date: Mon, 27 Apr 2009 17:36:26 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Konstanty <konstanty@...il.com>
Subject: Re: CVE Request -- libmodplug

Hello Steve,

  FYI Konstanty has added more checks (for // Sample Names
potential overflow) and also null terminations for
relevant strings (to ensure string safety) at:

http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.2&amp;amp;amp;r2=1.3&amp;amp;amp;view=patch

So new 0.8.7 release of libmodplug is available.

Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

On Tue, 2009-04-21 at 14:47 +0200, Jan Lieskovsky wrote:
> Hello Steve,
> 
>   could you please allocate a new CVE-2008-XXXX identifier for
> the following old libmodplug issue:
> 
> References:
> http://bugs.gentoo.org/show_bug.cgi?id=266913
> http://www.securityfocus.com/bid/30801/info
> http://sourceforge.net/project/shownotes.php?release_id=677065&amp;group_id=1275
> https://bugzilla.redhat.com/show_bug.cgi?id=496834
> 
> Affected libmodplug versions: x < 0.8.6
> 
> Patch (against modplug-xmms/libmodplug):
> http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&amp;r2=1.2
> 
> Thanks, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
> 
> 
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.