Sicherheit: Mehrere Probleme in adplug
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in adplug
ID: FEDORA-2021-64168929e4
Distribution: Fedora
Plattformen: Fedora 33
Datum: Do, 14. Januar 2021, 08:14
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14691
Applikationen: adplug


Fedora Update Notification
2021-01-14 01:37:01.292546

Name : adplug
Product : Fedora 33
Version : 2.3.3
Release : 1.fc33
URL : https://adplug.github.io/
Summary : Software library for AdLib (OPL2/3) emulation
Description :
AdPlug is a free software, cross-platform, hardware independent AdLib
sound player library, mainly written in C++. AdPlug plays sound data,
originally created for the AdLib (OPL2/3) audio board, directly from
its original format on top of an OPL2/3 emulator or by using the real
hardware. No OPL2/3 chips are required for playback.

Update Information:

AdPlug 2.3.3 ============ - New RAD player replacing the old one - Bug
fixes: (huge thanks to Alexander Miller for these) - CVE-2019-14690 -
overflow in `.bmf` - CVE-2019-14691 - buffer overflow in `.dtm` -
CVE-2019-14692 - buffer overflow in `.mkj` - CVE-2019-14732 - buffer
overflow in `.a2m` - CVE-2019-14733 - buffer overflow in `.rad` -
CVE-2019-14734 - buffer overflow in `.mtk` - CVE-2019-15151 - double free
and OOB reads in `.u6m` - OOB reads in `.xad` - OOB reads in `.rix`
AdPlug 2.3.2 ============ - Bug fixes: - FMOPL: Fix global variable
pointer double-free (CVE-2018-17825) - HERAD: Fix compilation on GCC 4.2.1
- ADL: Calling `rewind()` before `update()` causes access violation - Move
OPL reset/init code to `rewind()` for some players AdPlug 2.3.1 ============
- Fixed unconditional inclusion of "sys/io.h" on Linux - Autotools
- Non-recursive Automake, improved parallelizability - Compatibility fixes
for FreeBSD's pmake and OpenBSD's make - Out-of-source building
AdPlug 2.3
========== - Bug fixes: - CMF: Fix uninitialised variable use (thanks
binarymaster) - CMF: Handle invalid offsets without crashing - ROL:
Prevent access beyond end of vector - MSC: Fix use of uninitialised
- HSC: Handle out of range patterns more gracefully - MID: Fix out of range
array read - LDS: Use the tempo stored inside the Loudness-File instead of
simply returning 70Hz - RIX: Fix several replay bugs (thanks to Palxex)
- RIX: Big-endian fix by Wei Mingzhi - XAD: Tempo fix - Various other
out of bounds array fixes, timing fixes, etc. - New formats: - BMF: Easy
AdLib 1.0 - CMF: SoundFX Macs Opera - GOT: God of Thunder -
HSQ/SQX/SDB/AGD/HA2: Herbulot AdLib System (HERAD) - MUS/IMS/MDI: AdLib
Visual Composer ROL derivatives - SOP: sopepos' Note Player - VGM:
Game Music - Allow compilation on platforms that don't support real OPL
hardware access - Add support for compiling on Appveyor and publishing a
package - Add Visual Studio 2015 projects - Add support for Travis CI
- Add new CRC16 and CRC32 tests - Addition of WoodyOPL from DOSBox SVN
to NY00123) - Addition of NukedOPL (thanks to loki666 and nukeykt) - Move
from SourceForge to GitHub - DRO player refactored (thanks to Laurence Myers
and William Yates) - Add (mono) OPL3 support to the surround/harmonic-effect
OPL - Fix occasional random noise in right channel when using surround OPL
Satoh synth - Add display for ROL comment and instrument names - Improve
support for different Westwood ADL format versions - Improve CMF transpose
support (per-channel now) - Autotools build environment updated

* Tue Jan 5 2021 Robert Scheck <robert@fedoraproject.org> - 2.3.3-1
- Upgrade to 2.3.3 (#1743108, #1770224, #1770243, #1770257,

[ 1 ] Bug #1743108 - CVE-2019-15151 adplug: double free in function
Cu6mPlayer in u6m.h
[ 2 ] Bug #1770224 - CVE-2019-14692 adplug: heap-based buffer overflow in
CmkjPlayer::load() in mkj.cpp leads to arbitrary code execution
[ 3 ] Bug #1770243 - CVE-2019-14690 adplug: heap-based buffer overflow in
CxadbmfPlayer::__bmf_convert_stream() in bmf.cpp leads to arbitrary code execution
[ 4 ] Bug #1770257 - CVE-2019-14691 adplug: heap-based buffer overflow in
CdtmLoader::load() in dtm.cpp leads to arbitrary code execution
[ 5 ] Bug #1778710 - CVE-2019-14734 adplug: multiple heap-based buffer
overflows in CmtkLoader::load() in mtk.cpp
[ 6 ] Bug #1778716 - CVE-2019-14732 adplug: multiple heap-based buffer
overflows in Ca2mLoader::load() in a2m.cpp
[ 7 ] Bug #1778720 - CVE-2019-14733 adplug: multiple heap-based buffer
overflows in CradLoader::load() in rad.cp

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2021-64168929e4' at the command
line. For more information, refer to the dnf documentation available at

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org
Pro-Linux @Facebook
Neue Nachrichten