libmikmod Version 3.1.12 Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	41917
Class:	Boundary Condition Error
CVE:	CVE-2010-2546
Remote:	Yes
Local:	No
Published:	Jul 23 2010 12:00AM
Updated:	Mar 06 2012 05:20PM
Credit:	Tomas Hoger
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 libmikmod libmikmod 3.1.12 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:

libmikmod Version 3.1.12 Multiple Buffer Overflow Vulnerabilities

The 'libmikmod' library is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.

Attackers can leverage these issues to execute arbitrary code in the context of an application that uses the affected library. Failed attacks will cause denial-of-service conditions.

These issues are due to an incomplete fix for CVE-2009-3995; BID 38114 (libmikmod Multiple Buffer Overflow Vulnerabilities) is related to these issues.

libmikmod Version 3.1.12 Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

libmikmod Version 3.1.12 Multiple Buffer Overflow Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu4.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu4.1_sparc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu4.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu4.1_sparc.deb

Debian Linux 5.0 ia-64

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_ia64.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_ia64.deb

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.3.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.3.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.8.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.8.04.1_powerpc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.8.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.8.04.1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.8.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.8.04.1_sparc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.8.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.8.04.1_sparc.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.2.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.2.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu4.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu4.1_powerpc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu4.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu4.1_powerpc.deb

Debian Linux 5.0 alpha

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_alpha.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_alpha.deb

Debian Linux 5.0 ia-32

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_i386.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_i386.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva lib64mikmod-devel-3.1.11a-8.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod2-3.1.11a-8.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.8.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu3.8.04.1_amd64.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.8.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu3.8.04.1_amd64.deb

MandrakeSoft Enterprise Server 5

• Mandriva libmikmod-devel-3.2.0-0.beta2.2.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.2.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 s/390

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_s390.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_s390.deb

Mandriva Linux Mandrake 2008.0

• Mandriva libmikmod-devel-3.1.11a-8.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod2-3.1.11a-8.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu4.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu4.1_lpia.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu4.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu4.1_lpia.deb

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.7.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.7.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 mipsel

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_mipsel.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_mipsel.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.9.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.9.04.1_sparc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.9.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.9.04.1_sparc.deb

Mandriva Linux Mandrake 2010.0

• Mandriva libmikmod-devel-3.2.0-0.beta2.6.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.6.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.9.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.9.04.1_powerpc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.9.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.9.04.1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.8.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.8.04.1_lpia.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.8.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.8.04.1_lpia.deb

Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.6.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.6.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 hppa

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_hppa.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_hppa.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.9.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu3.9.04.1_i386.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.9.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu3.9.04.1_i386.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.9.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.9.04.1_lpia.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.9.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.9.04.1_lpia.deb

Mandriva Linux Mandrake 2010.1

• Mandriva libmikmod-devel-3.2.0-0.beta2.7.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.7.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 arm

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_arm.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_arm.deb

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu4.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu4.1_i386.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu4.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu4.1_i386.deb

Mandriva Linux Mandrake 2009.0

• Mandriva libmikmod-devel-3.2.0-0.beta2.2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 armel

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_armel.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_armel.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu4.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu4.1_amd64.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu4.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu4.1_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.8.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu3.8.04.1_i386.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.8.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu3.8.04.1_i386.deb

Debian Linux 5.0 amd64

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_amd64.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_amd64.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.9.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu3.9.04.1_amd64.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.9.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu3.9.04.1_amd64.deb

Mandriva Linux Mandrake 2009.1

• Mandriva libmikmod-devel-3.2.0-0.beta2.3.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.3.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 powerpc

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_powerpc.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_powerpc.deb

Debian Linux 5.0 sparc

• Debian libmikmod2-dev_3.1.11-a-6.0.1+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6.0.1+lenny1_sparc.deb


• Debian libmikmod2_3.1.11-a-6.0.1+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6.0.1+lenny1_sparc.deb

libmikmod Version 3.1.12 Multiple Buffer Overflow Vulnerabilities

References:

• Bug 614643 - (CVE-2009-3995, CVE-2009-3996) CVE-2009-3995 CVE-2009-3996 libmikmo (Vincent Danen)
  
• Incorrect fix for SA37775 / CVE-2009-3995 - ID: 3033086 (Tomas Hoger)
  
• libmikmod Web Site (libmikmod )