SUSE-SU-2018:1441-1

Dashboard / Vulnerabilities / SUSE-SU-2018:1441-1

SUSE-SU-2018:1441-1

Summary: Security update for libmodplug

Details: This update for libmodplug fixes the following issues: - Update to version 0.8.9.0+git20170610.f6dd59a bsc#1022032: * PSM: add missing line to commit * ABC: prevent possible increment of p past end * ABC: ensure read pointer is valid before incrementing * ABC: terminate early when things don't work in substitute * OKT: add one more bound check * FAR: out by one on check * ABC: 10 digit ints require null termination * PSM: make sure reads occur of only valid ins * ABC: cleanup tracks correctly. * WAV: check that there is space for both headers * OKT: ensure file size is enough to contain data * ABC: initialize earlier * ABC: ensure array access is bounded correctly. * ABC: clean up loop exiting code * ABC: avoid possibility of incrementing *p * ABC: abort early if macro would be blank * ABC: Use blankline more often * ABC: Ensure for loop does not increment past end of loop * Initialize nPatterns to 0 earlier * Check memory position isn't over the memory length * ABC: transpose only needs to look at notes (<26) - Update to version 0.8.9.0+git20171024.e9fc46e: * Spelling fixes * Bump version number to 0.8.9.0 * MMCMP: Check that end pointer is within the file size * WAV: ensure integer doesn't overflow * XM: additional mempos check * sndmix: Don't process row if its empty. * snd_fx: dont include patterns of zero size in length calc * MT2,AMF: prevent OOB reads - Add patch for broken pc file where quite some upstream refer to modplug directly without specifying the subdir it is in. - Update to version 0.8.8.5 * Some security issues: CVE-2013-4233, CVE-2013-4234, as well as many fixes suggested by static analyzers: clang build-scan, and coverity. - Stop using dos2unix - Run through spec-cleaner - Use full URL in Source tag

References: https://www.suse.com/support/update/announcement/2018/suse-su-20181441-1/, https://bugzilla.suse.com/1022032, https://www.suse.com/security/cve/CVE-2013-4233, https://www.suse.com/security/cve/CVE-2013-4234