Description
libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playback calculations, which allows user-assisted attackers to cause a denial of service (application crash) by loading multiple songs (aka MOD files) with different numbers of channels.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libmikmod | 3.1.11-6.1 | — |
| Debian 14 | sdl-mixer1.2 | 1.2.8-1 | — |
| Debian 13 | libmikmod | 3.1.11-6.1 | — |
| Debian 13 | sdl-mixer1.2 | 1.2.8-1 | — |
| Debian 12 | libmikmod | 3.1.11-6.1 | — |
| Debian 12 | sdl-mixer1.2 | 1.2.8-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mikmod +1 | 3.1.6-39.el5_5.1 | RHSA-2010:0720 |
| RHEL 4 | mikmod +1 | 3.1.6-33.el4_8.1 | RHSA-2010:0720 |
| RHEL 3 | mikmod +1 | 3.1.6-23.el3 | RHSA-2010:0720 |
Advisories 1
- RHSA-2010:0720 Red Hat Security Advisory: mikmod security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 34259 third-party-advisory
- 33235 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=422021
- FEDORA-2009-9095 vendor-advisory
- SUSE-SR:2009:006 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- FEDORA-2009-9112 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=479829
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=461519
- [oss-security] 20090113 CVE Request -- libmikmod mailing-list