This update of libmodplug0 fixes the following issues :

1) An integer overflow error exists within the 'CSoundFile::ReadWav()' function (src/load_wav.cpp) when processing certain WAV files. This can be exploited to cause a heap-based buffer overflow by tricking a user into opening a specially crafted WAV file. (CVE-2011-2911)

2) Boundary errors within the 'CSoundFile::ReadS3M()' function (src/load_s3m.cpp) when processing S3M files can be exploited to cause stack-based buffer overflows by tricking a user into opening a specially crafted S3M file. (CVE-2011-2912)

3) An off-by-one error within the 'CSoundFile::ReadAMS()' function (src/load_ams.cpp) can be exploited to cause a stack corruption by tricking a user into opening a specially crafted AMS file.
(CVE-2011-2913)

4) An off-by-one error within the 'CSoundFile::ReadDSM()' function (src/load_dms.cpp) can be exploited to cause a memory corruption by tricking a user into opening a specially crafted DSM file.
(CVE-2011-2914)

5) An off-by-one error within the 'CSoundFile::ReadAMS2()' function (src/load_ams.cpp) can be exploited to cause a memory corruption by tricking a user into opening a specially crafted AMS file.
(CVE-2011-2915)

Also an overflow in the ABC loader was fixed. (CVE-2011-1761)

The gstreamer-plugins packages contain plug-ins used by the GStreamer streaming-media framework to support a wide variety of media formats.

An integer overflow flaw, a boundary error, and multiple off-by-one flaws were found in various ModPlug music file format library (libmodplug) modules, embedded in GStreamer. An attacker could create specially crafted music files that, when played by a victim, would cause applications using GStreamer to crash or, potentially, execute arbitrary code. (CVE-2011-2911, CVE-2011-2912, CVE-2011-2913, CVE-2011-2914, CVE-2011-2915)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing the update, all applications using GStreamer (such as Rhythmbox) must be restarted for the changes to take effect.

Update to upstream version 0.8.8.4.

http://modplug-xmms.sourceforge.net/#news http://secunia.com/advisories/45131

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Hossein Lotfi discovered that libmodplug did not correctly handle certain malformed media files. If a user or automated system were tricked into opening a crafted media file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. (CVE-2011-2911, CVE-2011-2912, CVE-2011-2913)

It was discovered that libmodplug did not correctly handle certain malformed media files. If a user or automated system were tricked into opening a crafted media file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. (CVE-2011-2914, CVE-2011-2915).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
75902	openSUSE Security Update : libmodplug (openSUSE-SU-2011:0943-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
61131	Scientific Linux Security Update : gstreamer-plugins on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
55870	Fedora 15 : libmodplug-0.8.8.4-1.fc15 (2011-10544)	Nessus	Fedora Local Security Checks	2011/8/17	2021/1/11	medium
75586	openSUSE Security Update : libmodplug (openSUSE-SU-2011:0943-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
55869	Fedora 14 : libmodplug-0.8.8.4-1.fc14 (2011-10503)	Nessus	Fedora Local Security Checks	2011/8/17	2021/1/11	medium
56767	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : libmodplug vulnerabilities (USN-1255-1)	Nessus	Ubuntu Local Security Checks	2011/11/10	2019/9/19	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium