Security update for libmodplug

Announcement ID: SUSE-SU-2018:1441-1
Rating: moderate
References:
Cross-References:
CVSS scores:
Affected Products:
  • SUSE Linux Enterprise Desktop 12 SP3
  • SUSE Linux Enterprise High Performance Computing 12 SP3
  • SUSE Linux Enterprise Server 12 SP3
  • SUSE Linux Enterprise Server for SAP Applications 12 SP3
  • SUSE Linux Enterprise Software Development Kit 12 SP3

An update that solves two vulnerabilities can now be installed.

Description:

This update for libmodplug fixes the following issues:

  • Update to version 0.8.9.0+git20170610.f6dd59a bsc#1022032:
  • PSM: add missing line to commit
  • ABC: prevent possible increment of p past end
  • ABC: ensure read pointer is valid before incrementing
  • ABC: terminate early when things don't work in substitute
  • OKT: add one more bound check
  • FAR: out by one on check
  • ABC: 10 digit ints require null termination
  • PSM: make sure reads occur of only valid ins
  • ABC: cleanup tracks correctly.
  • WAV: check that there is space for both headers
  • OKT: ensure file size is enough to contain data
  • ABC: initialize earlier
  • ABC: ensure array access is bounded correctly.
  • ABC: clean up loop exiting code
  • ABC: avoid possibility of incrementing *p
  • ABC: abort early if macro would be blank
  • ABC: Use blankline more often
  • ABC: Ensure for loop does not increment past end of loop
  • Initialize nPatterns to 0 earlier
  • Check memory position isn't over the memory length
  • ABC: transpose only needs to look at notes (<26)

  • Update to version 0.8.9.0+git20171024.e9fc46e:

  • Spelling fixes
  • Bump version number to 0.8.9.0
  • MMCMP: Check that end pointer is within the file size
  • WAV: ensure integer doesn't overflow
  • XM: additional mempos check
  • sndmix: Don't process row if its empty.
  • snd_fx: dont include patterns of zero size in length calc
  • MT2,AMF: prevent OOB reads

  • Add patch for broken pc file where quite some upstream refer to modplug directly without specifying the subdir it is in.

  • Update to version 0.8.8.5

  • Some security issues: CVE-2013-4233, CVE-2013-4234, as well as many fixes suggested by static analyzers: clang build-scan, and coverity.
  • Stop using dos2unix
  • Run through spec-cleaner
  • Use full URL in Source tag

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Desktop 12 SP3
    zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-984=1
  • SUSE Linux Enterprise Software Development Kit 12 SP3
    zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-984=1
  • SUSE Linux Enterprise Server 12 SP3
    zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-984=1
  • SUSE Linux Enterprise High Performance Computing 12 SP3
    zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-984=1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP3
    zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-984=1

Package List:

  • SUSE Linux Enterprise Desktop 12 SP3 (x86_64)
    • libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
    • libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1
    • libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1
  • SUSE Linux Enterprise Software Development Kit 12 SP3 (aarch64 ppc64le s390x x86_64)
    • libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
    • libmodplug-devel-0.8.9.0+git20170610.f6dd59a-15.4.1
  • SUSE Linux Enterprise Server 12 SP3 (aarch64 ppc64le s390x x86_64)
    • libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
    • libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1
    • libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1
  • SUSE Linux Enterprise High Performance Computing 12 SP3 (aarch64 x86_64)
    • libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
    • libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1
    • libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP3 (ppc64le x86_64)
    • libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
    • libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1
    • libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1

References: