CVE-2016-9959
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
- Record
CVE-2016-9959- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
CVE List No score
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
- Record
CVE-2016-9959- Updated
- 2026-11-02
EUVDEUVD-2016-10745 No score
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
- Record
EUVD-2016-10745- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fr5p-jv24-2gw9
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
- Record
GHSA-fr5p-jv24-2gw9- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
- Record
CVE-2016-9959- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-9959
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
- Record
DEBIAN-CVE-2016-9959- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2016-9959
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
- Record
UBUNTU-CVE-2016-9959- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0428 No score
Updated game-music-emu packages fix security vulnerabilities
Chris Evans discovered that incorrect emulation of the SPC700 audio co-processor of the Super Nintendo Entertainment System allows the execution of arbitrary code if a malformed SPC music file is opened (CVE-2016-9957, CVE-2016-9958, CVE-2016-9959, CVE-2016-9960, CVE-2016-9961).
- Record
MGASA-2016-0428- Updated
- 2026-11-02
OSVMGASA-2017-0046 No score
Updated audacious-plugins packages fix security vulnerability
Chris Evans discovered that incorrect emulation of the SPC700 audio co-processor of the Super Nintendo Entertainment System allows the execution of arbitrary code if a malformed SPC music file is opened (CVE-2016-9957, CVE-2016-9958, CVE-2016-9959, CVE-2016-9960, CVE-2016-9961).
These issues were previously fixed in MGASA-2016-0428 in the game-music-emu library, but audacious-plugins contains a decoder built with a bundled copy, which has been patched to fix the issues.
- Record
MGASA-2017-0046- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10944-1 No score
libgme-devel-0.6.3-1.3 on GA media
These are all security issues fixed in the libgme-devel-0.6.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10944-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:3250-1 No score
Security update for libgme
This update for libgme fixes the following issues:
- CVE-2016-9957, CVE-2016-9958, CVE-2016-9959, CVE-2016-9960, CVE-2016-9961: Various issues were fixed in the handling of SPC music files that could have been exploited for gaining privileges of desktop users. [bsc#1015941]
- Record
SUSE-SU-2016:3250-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
game-music-emuDebian:12 |
before 0.6.0-4 | 0.6.0-4 |
game-music-emuDebian:13 |
before 0.6.0-4 | 0.6.0-4 |
game-music-emuDebian:14 |
before 0.6.0-4 | 0.6.0-4 |
game-music-emuDebian:7 From an advisory covering 5 CVEs |
before 0.5.5-2+deb7u1, plus listed versions 0.5.5-2 |
0.5.5-2+deb7u1 |
game-music-emuDebian:8 From an advisory covering 5 CVEs |
before 0.5.5-2+deb8u1, plus listed versions 0.5.5-2 |
0.5.5-2+deb8u1 |
game-music-emuMageia:5 From an advisory covering 5 CVEs |
before 0.6.1-1.mga5 | 0.6.1-1.mga5 |
audacious-pluginsMageia:5 From an advisory covering 5 CVEs |
before 3.5.2-2.1.mga5 | 3.5.2-2.1.mga5 |
audacious-pluginsMageia:5 From an advisory covering 5 CVEs |
before 3.5.2-2.1.mga5.tainted | 3.5.2-2.1.mga5.tainted |
libgmeSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 5 CVEs |
before 0.6.0-5.1 | 0.6.0-5.1 |
libgmeSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 5 CVEs |
before 0.6.0-5.1 | 0.6.0-5.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libgmeSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 5 CVEs |
before 0.6.0-5.1 | 0.6.0-5.1 |
libgmeSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 5 CVEs |
before 0.6.0-5.1 | 0.6.0-5.1 |
libgmeSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 5 CVEs |
before 0.6.0-5.1 | 0.6.0-5.1 |
libgmeSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 5 CVEs |
before 0.6.0-5.1 | 0.6.0-5.1 |
libgmeSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 5 CVEs |
before 0.6.0-5.1 | 0.6.0-5.1 |
libgmeSUSE:Linux Enterprise Server 12 SP2 From an advisory covering 5 CVEs |
before 0.6.0-5.1 | 0.6.0-5.1 |
libgmeSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 5 CVEs |
before 0.6.0-5.1 | 0.6.0-5.1 |
game-music-emuUbuntu:14.04:LTS |
before 0.5.5-2ubuntu0.14.04.1, plus listed versions 0.5.5-2 |
0.5.5-2ubuntu0.14.04.1 |
game-music-emuUbuntu:16.04:LTS |
before 0.6.0-3ubuntu0.16.04.1, plus listed versions 0.5.5-2.10.6.0-3 |
0.6.0-3ubuntu0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-9959 is a high vulnerability (CVSS 7.8) in Game-music-emu Project Game-music-emu, published December 15, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile. Fixed in game-music-emu 0.6.0-4.
References
lists.opensuse.org/opensuse-security-announce/2016-12/msg00090.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHAQI5Q2XDSPGRRKPJJM3A73VWAFSFL
securityfocus.com/bid/95305
openwall.com/lists/oss-security/2016/12/15/11
scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html
security.gentoo.org/glsa/201707-02
Show 28 moreShow less
bitbucket.org/mpyne/game-music-emu/wiki/Home
nvd.nist.gov/vuln/detail/CVE-2016-9959
github.com/advisories/GHSA-fr5p-jv24-2gw9
security-tracker.debian.org/tracker/CVE-2016-9959
advisories.mageia.org/MGASA-2016-0428.html
bugs.mageia.org/show_bug.cgi?id=19952
scarybeastsecurity.blogspot.de/2016/12/redux-compromising-linux-using-snes.html
debian.org/security/2016/dsa-3735
suse.com/support/update/announcement/2016/suse-su-20163250-1
bugzilla.suse.com/1015941
ubuntu.com/security/CVE-2016-9959
cve.org/CVERecord?id=CVE-2016-9959