Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 480388 (CVE-2013-4234) - <media-libs/libmodplug- ABC File Parsing Vulnerabilities (CVE-2013-{4233,4234})
Summary: <media-libs/libmodplug- ABC File Parsing Vulnerabilities (CVE-2013-{4...
Alias: CVE-2013-4234
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B2 [glsa]
Depends on: 519372 519886
  Show dependency tree
Reported: 2013-08-09 16:30 UTC by Agostino Sarubbo
Modified: 2014-08-16 18:16 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-08-09 16:30:07 UTC
From ${URL} :


SCRT Information Security has discovered two vulnerabilities in libmodplug, which can be exploited by malicious people to compromise an application using the library.

1) An error within the "abc_MIDI_drum()" function (src/load_abc.cpp) can be exploited to cause a buffer overflow via a specially crafted ABC file.

2) An integer overflow within the "abc_set_parts()" function (src/load_abc.cpp) can be exploited to corrupt heap memory via a specially crafted ABC file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are confirmed in version Other versions may also be affected.

No official solution is currently available.

Provided and/or discovered by:
agixid, SCRT Information Security

Original Advisory:

@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2013-09-17 22:49:35 UTC
CVE-2013-4234 (
  Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2)
  abc_MIDI_gchord functions in load_abc.cpp in libmodplug and earlier
  allow remote attackers to cause a denial of service (memory corruption and
  crash) and possibly execute arbitrary code via a crafted ABC.
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2013-09-17 22:53:33 UTC
CVE-2013-4233 (
  Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug and earlier allows remote attackers to cause a denial of service and
  possibly execute arbitrary code via a crafted P header in an ABC file, which
  triggers a heap-based buffer overflow.
Comment 3 Tony Vroon (RETIRED) gentoo-dev 2014-08-04 21:54:22 UTC
+*libmodplug- (04 Aug 2014)
+  04 Aug 2014; Tony Vroon <> +libmodplug-,
+  +files/libmodplug-,
+  +files/libmodplug-, metadata.xml:
+  Version bump, as requested by Tom Wijsman in bug #516926. Handle OMF2097 PSM
+  files correctly, filed upstream on Github as pull request 19.

Arches, please test & mark stable:

Target stable keywords: alpha amd64 arm hppa ia64 ppc ppc64 sh sparc x86
Comment 4 Jeroen Roovers (RETIRED) gentoo-dev 2014-08-06 21:32:36 UTC
Stable for HPPA.
Comment 5 Andreas Schürch gentoo-dev 2014-08-07 20:12:48 UTC
x86 stable
Comment 6 Tobias Klausmann (RETIRED) gentoo-dev 2014-08-08 13:58:40 UTC
Stable on alpha.
Comment 7 Agostino Sarubbo gentoo-dev 2014-08-08 21:35:49 UTC
ppc stable
Comment 8 Agostino Sarubbo gentoo-dev 2014-08-09 10:48:59 UTC
ppc64 stable
Comment 9 Agostino Sarubbo gentoo-dev 2014-08-09 13:22:31 UTC
amd64 stable
Comment 10 Agostino Sarubbo gentoo-dev 2014-08-10 09:14:25 UTC
ia64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2014-08-10 17:27:21 UTC
sparc stable
Comment 12 Markus Meier gentoo-dev 2014-08-13 15:21:10 UTC
arm stable, all arches done.
Comment 13 Tony Vroon (RETIRED) gentoo-dev 2014-08-13 16:20:30 UTC
+  13 Aug 2014; Tony Vroon <> -libmodplug-,
+  -libmodplug-, -libmodplug-
+  Remove vulnerable ebuilds for security bug #480388.

Security, please vote.
Comment 14 Yury German Gentoo Infrastructure gentoo-dev 2014-08-15 23:39:11 UTC
Arches and Maintainer(s), Thank you for your work.

> Security, please vote.

This is a B2 which is as per security policy is an automatic GLSA without a vote.

New GLSA Request filed.
Comment 15 GLSAMaker/CVETool Bot gentoo-dev 2014-08-16 18:16:51 UTC
This issue was resolved and addressed in
 GLSA 201408-07 at
by GLSA coordinator Mikle Kolyada (Zlogene).