CVE-2019-14523
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a...
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
- Record
CVE-2019-14523- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-191
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
- Record
CVE-2019-14523- Updated
- 2026-11-02
EUVDEUVD-2019-5693 No score
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
- Record
EUVD-2019-5693- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g8jp-jv8p-3qr4
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a...
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
- Record
GHSA-g8jp-jv8p-3qr4- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
OSV
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
- Record
CVE-2019-14523- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-14523
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
- Record
DEBIAN-CVE-2019-14523- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2019-14523
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
- Record
UBUNTU-CVE-2019-14523- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1994-1 No score
Security update for schismtracker
This update for schismtracker fixes the following issues:
The following security issues were fixed:
- CVE-2019-14523: Fixed an integer underflow in the Amiga Oktalyzer parser (boo#1144266).
- CVE-2019-14524: Fixed a heap overflow in the MTM loader (boo#1144261).
The following non-security issues were fixed:
- Support 15-channel MOD files.
- Support undocumented MIDI macro characters, and support character p (MIDI program) properly.
- Record
openSUSE-SU-2019:1994-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2019-1 No score
Security update for schismtracker
This update for schismtracker fixes the following issues:
The following security issues were fixed:
- CVE-2019-14523: Fixed an integer underflow in the Amiga Oktalyzer parser (boo#1144266).
- CVE-2019-14524: Fixed a heap overflow in the MTM loader (boo#1144261).
The following non-security issues were fixed:
- Support 15-channel MOD files.
- Support undocumented MIDI macro characters, and support character p (MIDI program) properly.
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:2019-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11373-1 No score
schismtracker-20210525-1.2 on GA media
These are all security issues fixed in the schismtracker-20210525-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11373-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
schismDebian:12 |
before 2:20190805-1 | 2:20190805-1 |
schismDebian:13 |
before 2:20190805-1 | 2:20190805-1 |
schismUbuntu:16.04:LTS |
All versions, plus listed versions 2:0+20110101-1build1 |
None known |
schismUbuntu:18.04:LTS |
All versions, plus listed versions 2:20160521-12:20170910-12:20180209-1 |
None known |
schismUbuntu:20.04:LTS |
before 2:20190805-1 | 2:20190805-1 |
schismtrackeropenSUSE:Leap 15.0 |
before 20190805-lp151.3.3.1 | 20190805-lp151.3.3.1 |
schismtrackeropenSUSE:Leap 15.1 |
before 20190805-lp151.3.3.1 | 20190805-lp151.3.3.1 |
schismtrackerSUSE:Package Hub 15 |
before 20190805-bp151.4.3.1 | 20190805-bp151.4.3.1 |
schismtrackerSUSE:Package Hub 15 SP1 |
before 20190805-bp151.4.3.1 | 20190805-bp151.4.3.1 |
schismtrackeropenSUSE:Tumbleweed |
before 20210525-1.2 | 20210525-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-14523 is a high vulnerability (CVSS 7.8) in Schismtracker Schism Tracker, published August 2, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in schism 2:20190805-1.
References
github.com/schismtracker/schismtracker/issues/202
lists.opensuse.org/opensuse-security-announce/2019-08/msg00072.html
security.gentoo.org/glsa/202107-12
nvd.nist.gov/vuln/detail/CVE-2019-14523
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2019-14523
ubuntu.com/security/CVE-2019-14523
cve.org/CVERecord?id=CVE-2019-14523
bugzilla.suse.com/1144261
suse.com/security/cve/CVE-2019-14523