SB2019092915 - OpenSUSE Linux update for libopenmpt

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2018-20860)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can create a specially crafted MED file, pass it to the affected application and perform a denial of service attack.

2) Input validation error (CVE-ID: CVE-2018-20861)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can create certain malformed custom tunings in MPTM file, pass it to the affected application and perform a denial of service (DoS) attack.

3) Reachable Assertion (CVE-ID: CVE-2019-14382)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion during file parsing with debug STLs in DSM. A remote attacker can pass a specially crafted file to the affected application and perform a denial of service (DoS) attack.

4) Reachable Assertion (CVE-ID: CVE-2019-14383)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the J2B in libopenmpt during file parsing with debug STLs. A remote attacker can pass a specially crafted file to the application and crash it.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00084.html