CVE-2010-2971
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of...
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
Exploit likelihood
What each source reports
NVD Score used
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
- Record
CVE-2010-2971- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
- Record
CVE-2010-2971- Updated
- 2026-11-02
EUVDEUVD-2010-2973 No score
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
- Record
EUVD-2010-2973- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7xx4-x85v-pc9j No score
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of...
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
- Record
GHSA-7xx4-x85v-pc9j- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
- Record
CVE-2010-2971- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-2971 No score
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
- Record
DEBIAN-CVE-2010-2971- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11462-1 No score
timidity-2.15.0-2.2 on GA media
These are all security issues fixed in the timidity-2.15.0-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11462-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libmikmodDebian:12 |
before 3.1.11-6.3 | 3.1.11-6.3 |
libmikmodDebian:13 |
before 3.1.11-6.3 | 3.1.11-6.3 |
libmikmodDebian:14 |
before 3.1.11-6.3 | 3.1.11-6.3 |
libmikmodDebian:5.0 From an advisory covering 3 CVEs |
before 3.1.11-6.0.1+lenny1, plus listed versions 3.1.11-63.1.11-6+lenny13.1.11-6.0.1 |
3.1.11-6.0.1+lenny1 |
timidityopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 2.15.0-2.2 | 2.15.0-2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2971 is a high vulnerability (CVSS 9.3) in Raphael Assenat Libmikmod, published August 1, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.69%, the 89th percentile. Fixed in libmikmod 3.1.11-6.3.