CVE catalog

CVE-2006-4046

ocp: CVE-2006-4046

Severity: High
Published: Aug 9, 2006, 11:04:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 15.63% · Oct 25, 2026

Multiple stack-based buffer overflows in Open Cubic Player 2.6.0pre6 and earlier for Windows, and 0.1.10_rc5 and earlier on Linux/BSD, allow remote attackers to execute arbitrary code via (1) a large .S3M file handled by the mpLoadS3M function, (2) a crafted .IT file handled by the itplayerclass::module::load function, (3) a crafted .ULT file handled by the mpLoadULT function, or (4) a crafted .AMS file handled by the mpLoadAMS function.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ocp	sid	`1:3.5.0+ds-2`	fixed
Debian	ocp	forky	`1:3.5.0+ds-2`	fixed
Debian	ocp	trixie	`1:3.0.1+ds-1`	fixed
Debian	ocp	bookworm	`1:0.2.101+ds-1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ocp	source	sid	`0.1.10rc6-1`	medium	Not reported	[381098]
Debian	ocp	source	forky	`0.1.10rc6-1`	medium	Not reported	[381098]
Debian	ocp	source	trixie	`0.1.10rc6-1`	medium	Not reported	[381098]
Debian	ocp	source	bookworm	`0.1.10rc6-1`	medium	Not reported	[381098]

[Debian bug #381098]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[opencubicplayer]Fixed
Source package: [ocp]
Details (2)
- 1:0.2.101+ds-1 · amd64 · bookworm
  Fixed · Fixed: 0.1.10rc6-1
  dsa · ocp · debian · bookworm; dsa · ocp · debian · 12
- 1:0.2.101+ds-1 · arm64 · bookworm
  Fixed · Fixed: 0.1.10rc6-1
  dsa · ocp · debian · bookworm; dsa · ocp · debian · 12
[opencubicplayer-doc]Fixed
Source package: [ocp]
Details (2)
- 1:0.2.101+ds-1 · all · bookworm
  Fixed · Fixed: 0.1.10rc6-1
  dsa · ocp · debian · bookworm; dsa · ocp · debian · 12
- 1:0.2.101+ds-1 · all · bookworm
  Fixed · Fixed: 0.1.10rc6-1
  dsa · ocp · debian · bookworm; dsa · ocp · debian · 12

[Debian 13 (Trixie)]

[opencubicplayer]Fixed
Source package: [ocp]
Details (3)
- 1:3.0.1+ds-1+b1 · amd64 · trixie
  Fixed · Fixed: 0.1.10rc6-1
  dsa · ocp · debian · 13
- 1:3.0.1+ds-1+b1 · arm64 · trixie
  Fixed · Fixed: 0.1.10rc6-1
  dsa · ocp · debian · 13
- 1:3.5.0+ds-2~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 0.1.10rc6-1
  dsa · ocp · debian · 13
[opencubicplayer-doc]Fixed
Source package: [ocp]
Details (2)
- 1:3.0.1+ds-1 · all · trixie
  Fixed · Fixed: 0.1.10rc6-1
  dsa · ocp · debian · 13
- 1:3.0.1+ds-1 · all · trixie
  Fixed · Fixed: 0.1.10rc6-1
  dsa · ocp · debian · 13

Observed: Oct 23, 2026, 5:03:09 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]