Description
libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sezero libmikmod
Default version status: unaffected
0 to < 3.3.14affected
pkg:github/sezero/mikmodReferences
- https://github.com/sezero/mikmod/commit/e7c6c9e88fbe3e8af4668a2e116bb8de341383f8 ↗
- https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_it.c#L198 ↗
- https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS ↗
- https://github.com/sezero/mikmod ↗
- https://www.vulncheck.com/advisories/libmikmod-before-3.3.14-heap-out-of-bounds-read-via-it-module-loader ↗