Debian Lenny: DSA-1850-1 Critical: Libmodplug Buffer Overflow

CVE-2009-1438

It was discovered that libmodplug is prone to an integer overflow when
processing a MED file with a crafted song comment or song name.

CVE-2009-1513

It was discovered that libmodplug is prone to a buffer overflow in the
PATinst function, when processing a long instrument name.


For the stable distribution (lenny), these problems have been fixed in
version 1:0.8.4-1+lenny1.

For the oldstable distribution (etch), these problems have been fixed in
version 1:0.7-5.2+etch1.

For the testing distribution (squeeze) and the unstable distribution
(sid), this problem has been fixed in version 1:0.8.7-1.


We recommend that you upgrade your libmodplug packages.


Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

...