CRITICAL9.3
Уязвимости операционной системы Gentoo Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
CVSS 2.0КРИТИЧЕСКАЯ 9.3
CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C
Серьёзность:
Закрытые проблемы (7)
MEDIUM4.3
libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playback calculations, which allows user-assisted attackers to cause a denial of service (application crash) by loading multiple songs (aka MOD files) with different numbers of channels.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PСсылки
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=422021
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=461519
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
- http://openwall.com/lists/oss-security/2009/01/13/2
- http://secunia.com/advisories/34259
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/33235
- https://bugzilla.redhat.com/show_bug.cgi?id=479829
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01305.html
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01312.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=422021
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=461519
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
- http://openwall.com/lists/oss-security/2009/01/13/2
- http://secunia.com/advisories/34259
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/33235
- https://bugzilla.redhat.com/show_bug.cgi?id=479829
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01305.html
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01312.html
MEDIUM4.3
libmikmod 3.1.11 through 3.2.0, as used by MikMod and possibly other products, allows user-assisted attackers to cause a denial of service (application crash) by loading an XM file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PСсылки
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476339
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
- http://openwall.com/lists/oss-security/2009/01/13/2
- http://secunia.com/advisories/34259
- http://www.securityfocus.com/bid/33240
- https://bugzilla.redhat.com/show_bug.cgi?id=479833
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01305.html
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01312.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476339
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
- http://openwall.com/lists/oss-security/2009/01/13/2
- http://secunia.com/advisories/34259
- http://www.securityfocus.com/bid/33240
- https://bugzilla.redhat.com/show_bug.cgi?id=479833
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01305.html
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01312.html
CRITICAL9.3
Multiple heap-based buffer overflows in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file. NOTE: some of these details are obtained from third party information.
CVSS 2.0КРИТИЧЕСКАЯ 9.3
CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:CСсылки
- http://forums.winamp.com/showthread.php?threadid=315355
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://secunia.com/advisories/37495
- http://secunia.com/advisories/40799
- http://secunia.com/secunia_research/2009-52/
- http://secunia.com/secunia_research/2009-53/
- http://secunia.com/secunia_research/2009-55/
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
- http://www.securityfocus.com/archive/1/508526/100/0/threaded
- http://www.securityfocus.com/archive/1/508527/100/0/threaded
- http://www.securityfocus.com/bid/37374
- http://www.vupen.com/english/advisories/2009/3575
- http://www.vupen.com/english/advisories/2010/1107
- http://www.vupen.com/english/advisories/2010/1957
- http://forums.winamp.com/showthread.php?threadid=315355
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://secunia.com/advisories/37495
- http://secunia.com/advisories/40799
- http://secunia.com/secunia_research/2009-52/
- http://secunia.com/secunia_research/2009-53/
- http://secunia.com/secunia_research/2009-55/
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
- http://www.securityfocus.com/archive/1/508526/100/0/threaded
- http://www.securityfocus.com/archive/1/508527/100/0/threaded
- http://www.securityfocus.com/bid/37374
- http://www.vupen.com/english/advisories/2009/3575
- http://www.vupen.com/english/advisories/2010/1107
- http://www.vupen.com/english/advisories/2010/1957
CRITICAL9.3
Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via an Ultratracker file.
CVSS 2.0КРИТИЧЕСКАЯ 9.3
CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:CСсылки
- http://forums.winamp.com/showthread.php?threadid=315355
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://secunia.com/advisories/37495
- http://secunia.com/secunia_research/2009-55/
- http://secunia.com/secunia_research/2009-56/
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
- http://www.securityfocus.com/archive/1/508528/100/0/threaded
- http://www.securityfocus.com/bid/37374
- http://www.vupen.com/english/advisories/2009/3575
- http://www.vupen.com/english/advisories/2010/1107
- http://forums.winamp.com/showthread.php?threadid=315355
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://secunia.com/advisories/37495
- http://secunia.com/secunia_research/2009-55/
- http://secunia.com/secunia_research/2009-56/
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
- http://www.securityfocus.com/archive/1/508528/100/0/threaded
- http://www.securityfocus.com/bid/37374
- http://www.vupen.com/english/advisories/2009/3575
- http://www.vupen.com/english/advisories/2010/1107
CRITICAL9.3
Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.
CVSS 2.0КРИТИЧЕСКАЯ 9.3
CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:CСсылки
- http://secunia.com/advisories/40799
- http://secunia.com/advisories/48244
- http://security.gentoo.org/glsa/glsa-201203-10.xml
- http://sourceforge.net/tracker/?func=detail&aid=3033086&group_id=40531&atid=428227
- http://www.debian.org/security/2010/dsa-2081
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
- http://www.securityfocus.com/bid/41917
- http://www.vupen.com/english/advisories/2010/1957
- https://bugzilla.redhat.com/show_bug.cgi?id=614643
- http://secunia.com/advisories/40799
- http://secunia.com/advisories/48244
- http://security.gentoo.org/glsa/glsa-201203-10.xml
- http://sourceforge.net/tracker/?func=detail&aid=3033086&group_id=40531&atid=428227
- http://www.debian.org/security/2010/dsa-2081
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
- http://www.securityfocus.com/bid/41917
- http://www.vupen.com/english/advisories/2010/1957
- https://bugzilla.redhat.com/show_bug.cgi?id=614643
CRITICAL9.3
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
CVSS 2.0КРИТИЧЕСКАЯ 9.3
CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:CСсылки
- http://secunia.com/advisories/48244
- http://security.gentoo.org/glsa/glsa-201203-10.xml
- http://sourceforge.net/tracker/?func=detail&aid=3033086&group_id=40531&atid=428227
- http://www.debian.org/security/2010/dsa-2081
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
- https://bugzilla.redhat.com/show_bug.cgi?id=614643
- http://secunia.com/advisories/48244
- http://security.gentoo.org/glsa/glsa-201203-10.xml
- http://sourceforge.net/tracker/?func=detail&aid=3033086&group_id=40531&atid=428227
- http://www.debian.org/security/2010/dsa-2081
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
- https://bugzilla.redhat.com/show_bug.cgi?id=614643