Описание
Security update for libmikmod
This update for libmikmod fixes the following issues:
Changes in libmikmod:
- CVE-2026-105839: make sure that numtrk calculation fits into an UWORD (bsc#1284366)
- CVE-2026-105838: bump itpat allocation to 256, matching allowed packlen limit (bsc#1284367)
- CVE-2026-105837: make sure that numtrk calculation fits into an UWORD (bsc#1284368)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1284366
- SUSE Bug 1284367
- SUSE Bug 1284368
- SUSE CVE CVE-2026-105837 page
- SUSE CVE CVE-2026-105838 page
- SUSE CVE CVE-2026-105839 page
Описание
libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.
Затронутые продукты
Ссылки
- CVE-2026-105837
- SUSE Bug 1284368
Описание
libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications.
Затронутые продукты
Ссылки
- CVE-2026-105838
- SUSE Bug 1284367
Описание
libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing PBOD writes past allocated track pointers for crashes or code execution.
Затронутые продукты
Ссылки
- CVE-2026-105839
- SUSE Bug 1284366