Ubuntu 11.04, 10.10, 10.04 LTS USN-1148-1 Moderate: libmodplug Code Risk

ubuntu

June 13, 2011

libmodplug could be made to run programs as your login if it opened a specially crafted file.

Summary

libmodplug could be made to run programs as your login if it opened a

specially crafted file.

Software Description:

- libmodplug: Library for mod music based on ModPlug

Details:

It was discovered that libmodplug did not correctly handle certain

malformed S3M media files. If a user or automated system were tricked into

opening a crafted S3M file, an attacker could cause a denial of service or

possibly execute arbitrary code with privileges of the user invoking the

program. (CVE-2011-1574)

It was discovered that libmodplug did not correctly handle certain

malformed ABC media files. If a user or automated system were tricked into

opening a crafted ABC file, an attacker could cause a denial of service or

possibly execute arbitrary code with privileges of the user invoking the

program. (CVE-2011-1761)

The default compiler options for affected releases should reduce the

vulnerability to a denial of service.

Topics Covered

security advisory denial of service security issue code execution Ubuntu libmodplug

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  libmodplug1                     1:0.8.8.1-2ubuntu0.2

Ubuntu 10.10:
  libmodplug1                     1:0.8.8.1-1ubuntu1.2

Ubuntu 10.04 LTS:
  libmodplug0c2                   1:0.8.7-1ubuntu0.2

In general, a standard system update will make all the necessary changes.