Description
In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libopenmpt | 0.4.9-1 | — |
| Debian 13 | libopenmpt | 0.4.9-1 | — |
| Debian 12 | libopenmpt | 0.4.9-1 | — |
| Debian 10 | libopenmpt | 0.4.3-1+deb10u1 | DSA-4729-1 |
| Debian 9 | libopenmpt | 0.2.7386~beta20.3-3+deb9u4 | DLA-2308-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | libopenmpt | 0.3.6-1ubuntu0.1~esm2 | USN-8206-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | libopenmpt | 0.3.19-2.10.1 | SUSE-SU-2019:2622-1 |
| SLES 15 | libopenmpt | 0.3.19-2.10.1 | SUSE-SU-2019:2622-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | libopenmpt | 0.3.19-lp151.2.6.1 | openSUSE-SU-2019:2306-1 |
| openSUSE Leap 15.0 | libopenmpt | 0.3.19-lp150.10.1 | openSUSE-SU-2019:2319-1 |
Advisories 6
- USN-8206-1 libopenmpt vulnerability Ubuntu Security Notices (USN) · May 7, 2026
- DSA-4729-1 libopenmpt - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2308-1 libopenmpt - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2019:2622-1 Security update for libopenmpt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2306-1 Security update for libopenmpt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2319-1 Security update for libopenmpt SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/OpenMPT/openmpt/commit/927688ddab43c2b203569de79407a899e734fabe
- https://source.openmpt.org/browse/openmpt/trunk/OpenMPT/?op=revision&rev=12127&peg=12127
- https://github.com/OpenMPT/openmpt/compare/libopenmpt-0.4.8...libopenmpt-0.4.9
- https://github.com/OpenMPT/openmpt/compare/libopenmpt-0.3.18...libopenmpt-0.3.19
- openSUSE-SU-2019:2306 vendor-advisory
- openSUSE-SU-2019:2319 vendor-advisory
- DSA-4729 vendor-advisory
- [debian-lts-announce] 20200801 [SECURITY] [DLA 2308-1] libopenmpt security update mailing-list