Security update for libmodplug

SUSE Security Update: Security update for libmodplug
Announcement ID: SUSE-SU-2018:1441-1
Rating: moderate
References: #1022032
Affected Products:
  • SUSE Linux Enterprise Software Development Kit 12-SP3
  • SUSE Linux Enterprise Server 12-SP3
  • SUSE Linux Enterprise Desktop 12-SP3

  • An update that fixes two vulnerabilities is now available.

    Description:

    This update for libmodplug fixes the following issues:

    - Update to version 0.8.9.0+git20170610.f6dd59a bsc#1022032:
    * PSM: add missing line to commit
    * ABC: prevent possible increment of p past end
    * ABC: ensure read pointer is valid before incrementing
    * ABC: terminate early when things don't work in substitute
    * OKT: add one more bound check
    * FAR: out by one on check
    * ABC: 10 digit ints require null termination
    * PSM: make sure reads occur of only valid ins
    * ABC: cleanup tracks correctly.
    * WAV: check that there is space for both headers
    * OKT: ensure file size is enough to contain data
    * ABC: initialize earlier
    * ABC: ensure array access is bounded correctly.
    * ABC: clean up loop exiting code
    * ABC: avoid possibility of incrementing *p
    * ABC: abort early if macro would be blank
    * ABC: Use blankline more often
    * ABC: Ensure for loop does not increment past end of loop
    * Initialize nPatterns to 0 earlier
    * Check memory position isn't over the memory length
    * ABC: transpose only needs to look at notes (
    - Update to version 0.8.9.0+git20171024.e9fc46e:
    * Spelling fixes
    * Bump version number to 0.8.9.0
    * MMCMP: Check that end pointer is within the file size
    * WAV: ensure integer doesn't overflow
    * XM: additional mempos check
    * sndmix: Don't process row if its empty.
    * snd_fx: dont include patterns of zero size in length calc
    * MT2,AMF: prevent OOB reads

    - Add patch for broken pc file where quite some upstream refer to modplug
    directly without specifying the subdir it is in.

    - Update to version 0.8.8.5
    * Some security issues: CVE-2013-4233, CVE-2013-4234, as well as many
    fixes suggested by static analyzers: clang build-scan, and coverity.
    - Stop using dos2unix
    - Run through spec-cleaner
    - Use full URL in Source tag

    Patch Instructions:

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Software Development Kit 12-SP3:
      zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-984=1
    • SUSE Linux Enterprise Server 12-SP3:
      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-984=1
    • SUSE Linux Enterprise Desktop 12-SP3:
      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-984=1

    Package List:

    • SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):
      • libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
      • libmodplug-devel-0.8.9.0+git20170610.f6dd59a-15.4.1
    • SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):
      • libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
      • libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1
      • libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1
    • SUSE Linux Enterprise Desktop 12-SP3 (x86_64):
      • libmodplug-debugsource-0.8.9.0+git20170610.f6dd59a-15.4.1
      • libmodplug1-0.8.9.0+git20170610.f6dd59a-15.4.1
      • libmodplug1-debuginfo-0.8.9.0+git20170610.f6dd59a-15.4.1

    References: