{"id":"CVE-2019-17113","aliases":["DEBIAN-CVE-2019-17113","DLA-2308-1","DSA-4729-1","EUVD-2019-7574","GHSA-9qmp-r7mf-m39c","SUSE-SU-2019:2622-1","UBUNTU-CVE-2019-17113","USN-8206-1","openSUSE-SU-2019:2306-1","openSUSE-SU-2019:2319-1","openSUSE-SU-2024:10965-1"],"status":"published","title":"In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName...","description":"In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02754,"percentile":0.86331,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2019-10-03T23:57:36Z","modified":"2026-10-20T13:40:53Z","fixes":[{"ecosystem":"Debian:12","package":"libopenmpt","fixed_in":["0.4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libopenmpt","fixed_in":["0.4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libopenmpt","fixed_in":["0.4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"libopenmpt","fixed_in":["0.2.7386~beta20.3-3+deb9u4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"libopenmpt","fixed_in":["0.3.19-2.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"libopenmpt","fixed_in":["0.3.19-2.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libopenmpt","fixed_in":["0.3.6-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"libopenmpt","fixed_in":["0.3.19-lp151.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"libopenmpt","fixed_in":["0.3.19-lp150.10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.7386~beta20.3-3+deb9u4"}]}],"versions":["0.2.7386~beta20.3-3","0.2.7386~beta20.3-3+deb9u1","0.2.7386~beta20.3-3+deb9u2","0.2.7386~beta20.3-3+deb9u3"]},{"source":"osv","ecosystem":"Debian:10","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3-1+deb10u1"}]}],"versions":["0.4.3-1"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.19-2.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.19-2.10.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-1ubuntu0.1~esm2"}]}],"versions":["0.2.8760~beta27-1","0.3.1-1","0.3.2-1","0.3.3-1","0.3.4-1","0.3.6-1","0.3.6-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-1ubuntu0.1~esm2"}]}],"versions":["0.2.8760~beta27-1","0.3.1-1","0.3.2-1","0.3.3-1","0.3.4-1","0.3.6-1","0.3.6-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.19-lp151.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libopenmpt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.19-lp150.10.1"}]}]}],"products":[{"vendor":"openmpt","product":"libopenmpt"}],"references":[{"url":"https://github.com/OpenMPT/openmpt/commit/927688ddab43c2b203569de79407a899e734fabe","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://source.openmpt.org/browse/openmpt/trunk/OpenMPT/?op=revision\u0026rev=12127\u0026peg=12127","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/OpenMPT/openmpt/compare/libopenmpt-0.4.8...libopenmpt-0.4.9","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/OpenMPT/openmpt/compare/libopenmpt-0.3.18...libopenmpt-0.3.19","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00035.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://www.debian.org/security/2020/dsa-4729","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00003.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17113"},{"url":"https://github.com/advisories/GHSA-9qmp-r7mf-m39c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17113","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192622-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1153102","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17113","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-17113","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17113","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8206-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W7AKBJWO3A3RH5D2TBIUPIFVWBCYTHDW/#W7AKBJWO3A3RH5D2TBIUPIFVWBCYTHDW","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HDNHYAXS2VE5ED6L6FIQ34DT3DZQZKWU/#HDNHYAXS2VE5ED6L6FIQ34DT3DZQZKWU","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14383","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-17113","description":"In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.","status":"published","published":"2019-10-03T23:57:36Z","modified":"2024-08-05T01:33:16.633Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7574","description":"In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.","status":"published","published":"2019-10-03T23:57:36Z","modified":"2024-08-05T01:33:16Z","updated_at":"2026-11-03T02:40:31.468839Z"}],"ghsa":[{"id":"GHSA-9qmp-r7mf-m39c","title":"In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName...","description":"In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.","status":"published","published":"2022-05-24T16:57:52Z","modified":"2023-01-28T05:07:15Z","updated_at":"2026-11-02T14:44:30.65038Z"}],"nvd":[{"id":"CVE-2019-17113","description":"In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.","status":"published","published":"2019-10-04T00:15:10.747Z","modified":"2026-06-17T02:23:19.973Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:05:31.019577Z"}],"osv":[{"id":"CVE-2019-17113","description":"In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.","status":"published","published":"2019-10-04T00:15:10.747Z","modified":"2026-10-20T13:40:53.489431353Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17113","description":"In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.","status":"published","published":"2019-10-04T00:15:10.747Z","modified":"2026-09-21T07:03:06.904400487Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-17113","description":"In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.","status":"published","published":"2019-10-04T00:15:00Z","modified":"2026-05-07T13:17:02.909156Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DLA-2308-1","title":"libopenmpt - security update","status":"published","published":"2020-08-02T00:00:00Z","modified":"2026-03-09T01:21:07.859769Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4729-1","title":"libopenmpt - security update","status":"published","published":"2020-07-19T00:00:00Z","modified":"2026-03-09T02:11:18.470077Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2019:2306-1","title":"Security update for libopenmpt","description":"This update for libopenmpt to version 0.3.19 fixes the following issues:\n\n- CVE-2019-17113: Fixed a buffer overflow in ModPlug_InstrumentName and ModPlug_SampleName (bsc#1153102).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-10T14:20:04Z","modified":"2026-02-04T02:56:14.736507Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2319-1","title":"Security update for libopenmpt","description":"This update for libopenmpt to version 0.3.19 fixes the following issues:\n\n- CVE-2019-17113: Fixed a buffer overflow in ModPlug_InstrumentName and ModPlug_SampleName (bsc#1153102).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-16T05:41:36Z","modified":"2026-02-04T02:28:16.161409Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10965-1","title":"libopenmpt-devel-0.5.11-1.2 on GA media","description":"These are all security issues fixed in the libopenmpt-devel-0.5.11-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:36:36.933971Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:2622-1","title":"Security update for libopenmpt","description":"This update for libopenmpt to version 0.3.19 fixes the following issues:\n\n- CVE-2019-17113: Fixed a buffer overflow in ModPlug_InstrumentName and ModPlug_SampleName (bsc#1153102).\n","status":"published","published":"2019-10-09T13:23:38Z","modified":"2026-02-04T03:30:29.285555Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-8206-1","title":"libopenmpt vulnerability","description":"Antonio Morales Maldonado discovered that OpenMPT did not properly limit\nthe length of strings in certain cases, leading to a buffer overflow.\nAn attacker could possibly use this issue to cause OpenMPT to crash,\nresulting in a denial of service.","status":"published","published":"2026-04-23T16:05:39Z","modified":"2026-05-07T13:29:34.836953942Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}