Alerts This Week
Warning Icon 1 1,213
Alerts This Week
Warning Icon 1 1,213

openSUSE: libxmp Moderate Stack Underflow Vulnerability 2025:0186-1

opensuse
Calendar Grey July 26, 2025
Dist Opensuse Esm H88
A new version is released for openSUSE, targeting a moderate security flaw in libxmp that could lead to stack underflow and potential application crashes.
An update that fixes one vulnerability is now available

Description

This update for libxmp fixes the following issues:

- Update to release 4.6.3

* Fix crashes when xmp_set_position/xmp_set_row is used to set a

negative position/row.

* Fix hangs when xmp_prev_position is used on the first position

of a sequence which is preceded by an S3M/IT skip marker.

* Fix out-of-bounds reads when xmp_next_position is used at the end of a

256 position module.

* Fix hangs when seeking to an end-of-module marker caused by these

positions getting assigned a non-existent sequence.

* Fix stack underflow in Pha Packer loader (CVE-2025-47256).

* Fix broken conversion of ProRunner 2.0 pattern data.

* xmp_set_tempo_factor no longer alters frame time calculation for

xmp_get_frame_info. Frame time is now updated to account for the new

time factor after calling xmp_scan_module.

* Fix loading XMs with some types of harmless pattern truncation.

* Fix Digital Tracker 2.03 position jump...

Read the Full Advisory

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP6:

zypper in -t patch openSUSE-2025-186=1

Package List

- openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64):

libxmp-devel-4.6.3-bp156.2.3.1

libxmp4-4.6.3-bp156.2.3.1

References

https://www.suse.com/security/cve/CVE-2025-47256.html

Announcement ID: openSUSE-SU-2025:0186-1
Rating: moderate
Affected Products: openSUSE Backports SLE-15-SP6 .

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here