Security update for libmodplug
| Announcement ID: | SUSE-SU-2018:1441-1 |
|---|---|
| Rating: | moderate |
| References: | |
| Cross-References: | |
| CVSS scores: |
|
| Affected Products: |
|
An update that solves two vulnerabilities can now be installed.
Description:
This update for libmodplug fixes the following issues:
- Update to version 0.8.9.0+git20170610.f6dd59a bsc#1022032:
- PSM: add missing line to commit
- ABC: prevent possible increment of p past end
- ABC: ensure read pointer is valid before incrementing
- ABC: terminate early when things don't work in substitute
- OKT: add one more bound check
- FAR: out by one on check
- ABC: 10 digit ints require null termination
- PSM: make sure reads occur of only valid ins
- ABC: cleanup tracks correctly.
- WAV: check that there is space for both headers
- OKT: ensure file size is enough to contain data
- ABC: initialize earlier
- ABC: ensure array access is bounded correctly.
- ABC: clean up loop exiting code
- ABC: avoid possibility of incrementing *p
- ABC: abort early if macro would be blank
- ABC: Use blankline more often
- ABC: Ensure for loop does not increment past end of loop
- Initialize nPatterns to 0 earlier
- Check memory position isn't over the memory length
-
ABC: transpose only needs to look at notes (<26)
-
Update to version 0.8.9.0+git20171024.e9fc46e:
- Spelling fixes
- Bump version number to 0.8.9.0
- MMCMP: Check that end pointer is within the file size
- WAV: ensure integer doesn't overflow
- XM: additional mempos check
- sndmix: Don't process row if its empty.
- snd_fx: dont include patterns of zero size in length calc
-
MT2,AMF: prevent OOB reads
-
Add patch for broken pc file where quite some upstream refer to modplug directly without specifying the subdir it is in.
-
Update to version 0.8.8.5
- Some security issues: CVE-2013-4233, CVE-2013-4234, as well as many fixes suggested by static analyzers: clang build-scan, and coverity.
- Stop using dos2unix
- Run through spec-cleaner
- Use full URL in Source tag
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Desktop 12 SP3
zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-984=1 -
SUSE Linux Enterprise Software Development Kit 12 SP3
zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-984=1 -
SUSE Linux Enterprise Server 12 SP3
zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-984=1 -
SUSE Linux Enterprise High Performance Computing 12 SP3
zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-984=1 -
SUSE Linux Enterprise Server for SAP Applications 12 SP3
zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-984=1
Package List:
-
SUSE Linux Enterprise Desktop 12 SP3 (x86_64)
- libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
- libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1
- libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1
-
SUSE Linux Enterprise Software Development Kit 12 SP3 (aarch64 ppc64le s390x x86_64)
- libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
- libmodplug-devel-0.8.9.0+git20170610.f6dd59a-15.4.1
-
SUSE Linux Enterprise Server 12 SP3 (aarch64 ppc64le s390x x86_64)
- libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
- libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1
- libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1
-
SUSE Linux Enterprise High Performance Computing 12 SP3 (aarch64 x86_64)
- libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
- libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1
- libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP3 (ppc64le x86_64)
- libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
- libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1
- libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1