This update for libxmp fixes the following issues:
- Update to release 4.6.3
* Fix crashes when xmp_set_position/xmp_set_row is used to set a
negative position/row.
* Fix hangs when xmp_prev_position is used on the first position
of a sequence which is preceded by an S3M/IT skip marker.
* Fix out-of-bounds reads when xmp_next_position is used at the end of a
256 position module.
* Fix hangs when seeking to an end-of-module marker caused by these
positions getting assigned a non-existent sequence.
* Fix stack underflow in Pha Packer loader (CVE-2025-47256).
* Fix broken conversion of ProRunner 2.0 pattern data.
* xmp_set_tempo_factor no longer alters frame time calculation for
xmp_get_frame_info. Frame time is now updated to account for the new
time factor after calling xmp_scan_module.
* Fix loading XMs with some types of harmless pattern truncation.
* Fix Digital Tracker 2.03 position jump...
Read the Full AdvisoryPatch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-186=1
- openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64):
libxmp-devel-4.6.3-bp156.2.3.1
libxmp4-4.6.3-bp156.2.3.1
https://www.suse.com/security/cve/CVE-2025-47256.html
Get the latest Linux and open source security news straight to your inbox.