Debian alert DLA-2308-1 (libopenmpt)

From:
             
 
Utkarsh Gupta <utkarsh@debian.org> 
To:
             
 
debian-lts-announce@lists.debian.org 
Subject:
             
 
[SECURITY] [DLA 2308-1] libopenmpt security update 
Date:
             
 
Sun, 2 Aug 2020 04:19:41 +0530
Message-ID:
             
 
<57b66604-8de5-a50c-8ac1-dbf566b07933@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -----------------------------------------------------------------------
Debian LTS Advisory DLA-2308-1              debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Utkarsh Gupta
August 02, 2020                             https://wiki.debian.org/LTS
- -----------------------------------------------------------------------

Package        : libopenmpt
Version        : 0.2.7386~beta20.3-3+deb9u4
CVE ID         : CVE-2019-17113


In libopenmpt before 0.3.19 and 0.4.x before 0.4.9,
ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c
do not restrict the lengths of libmodplug output-buffer strings in
the C API, leading to a buffer overflow.

For Debian 9 stretch, this problem has been fixed in version
0.2.7386~beta20.3-3+deb9u4.

We recommend that you upgrade your libopenmpt packages.

For the detailed security status of libopenmpt please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libopenmpt

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Best,
Utkarsh
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAl8l8XQACgkQgj6WdgbD
S5YXMxAAzvBe2RytEDGBRdSQrIODuVdVBnusnBq+ph2R4UR+eSK7fPJN4LuHOKsm
q4BzRHjUMpeMcuZyhS7LMAFK+1hscYNtrTS0bcOofWxqkA7WRg0k/lPCbbYU9ElB
k8pK9loQF3YENncZhAifXDR+omEObfD6nN80AUZLB/blsPFOV9E0LbbmdNq9epYC
3CQWdOrALcTRG4+Uam2/xLbiAhGHn7c6bmSn2iYLP/TQhW8irSaqq7wNPEcNZWQC
TxX2w3cLYBuXUJIkNuDuj/W9VadCoh6gzeJBKhqQ+lESKThpiiTc5hfYKCZMDKp/
C+FngT2VY2lTeMC78vQZD1nw4cwN8XRu6eexchMP+wJVX5W3XWW1ix9w86PPVyux
8Py+OS1Xuc5qGnv0FXZBFiZxB58I2Tco0isYqrfVTnqLONG4MIy1mMnCg7slD+oM
S4g2oYpDwpk+nakkQNv9o302V0ExtyZ1F+CmzIM9IRIec4l+1BFhjGpGGgKr9QvS
M5gLYWLwiR9BWDSPL1lwWKQwgmHxgwksxJrLQTYOhRnVWUoMhGO3Hi1mbDH8kfv5
QKMCKNasITMsFBdN6SvXUuDwf2luHBw6lDwvMcnE/KGKB/o1+Z3HLx6cIzXRE8aW
p8t1g8M+Ypv1AeC77rGoDos6+jKD3FhKgxusQBMZdscy7FcNFQs=
=55B7
-----END PGP SIGNATURE-----