--i0/AhcQY5QxfSsSZ

Content-Type: text/plain; charset=us-ascii

Content-Disposition: inline



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory                           GLSA 200612-04

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                                            http://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



  Severity: Normal

     Title: ModPlug: Multiple buffer overflows

      Date: December 10, 2006

      Bugs: #143404

        ID: 200612-04



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Synopsis

========



ModPlug contains several boundary errors that could lead to buffer

overflows resulting in the possible execution of arbitrary code.



Background

==========



ModPlug is a library for playing MOD-like music.



Affected packages

=================



    -------------------------------------------------------------------

     Package                /  Vulnerable  /                Unaffected

    -------------------------------------------------------------------

  1  media-libs/libmodplug      < 0.8-r1                     >= 0.8-r1



Description

===========



Luigi Auriemma has reported various boundary errors in load_it.cpp and

a boundary error in the "CSoundFile::ReadSample()" function in

sndfile.cpp.



Impact

======



A remote attacker can entice a user to read crafted modules or ITP

files, which may trigger a buffer overflow resulting in the execution

of arbitrary code with the privileges of the user running the

application.



Workaround

==========



There is no known workaround at this time.



Resolution

==========



All ModPlug users should upgrade to the latest version:



    # emerge --sync

    # emerge --ask --oneshot --verbose
 ">=media-libs/libmodplug-0.8-r1"



References

==========



  [ 1 ] CVE-2006-4192

        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4192



Availability

============



This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:



  http://security.gentoo.org/glsa/glsa-200612-04.xml



Concerns?

=========



Security is a primary focus of Gentoo Linux and ensuring the

confidentiality and security of our users machines is of utmost

importance to us. Any security concerns should be addressed to

security@gentoo.org or alternatively, you may file a bug at

http://bugs.gentoo.org.



License

=======



Copyright 2006 Gentoo Foundation, Inc; referenced text

belongs to its owner(s).



The contents of this document are licensed under the

Creative Commons - Attribution / Share Alike license.



http://creativecommons.org/licenses/by-sa/2.5



--i0/AhcQY5QxfSsSZ

Content-Type: application/pgp-signature

Content-Disposition: inline



-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.5 (GNU/Linux)



iD8DBQFFfAy4IS4GNEW6wBQRArjqAJ0eyxTS/b3xmA3ZFiE73PHsweHa7wCfSMM8

1CoV8alk0Rmxnt9j7TfuksM=

=nwFi

-----END PGP SIGNATURE-----



--i0/AhcQY5QxfSsSZ--

-- 

gentoo-announce@gentoo.org mailing list