CVE catalog

CVE-2009-1438

libmodplug: CVE-2009-1438

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
4.67% · Oct 25, 2026

Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products, allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name, which triggers a heap-based buffer overflow, as exploited in the wild in August 2008.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibmodplugsid1:0.8.9.0-4fixed
Debianlibmodplugforky1:0.8.9.0-4fixed
Debianlibmodplugtrixie1:0.8.9.0-3fixed
Debianlibmodplugbookworm1:0.8.9.0-3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibmodplugsourcesid1:0.8.7-1lowNot reported[526657]
Debianlibmodplugsourceforky1:0.8.7-1lowNot reported[526657]
Debianlibmodplugsourcetrixie1:0.8.7-1lowNot reported[526657]
Debianlibmodplugsourcebookworm1:0.8.7-1lowNot reported[526657]

[Debian bug #526657]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libmodplug1]Fixed

    Source package: [libmodplug]

    Details (2)

    • 1:0.8.9.0-3 · amd64 · bookworm

      Fixed · Fixed: 1:0.8.7-1

      dsa · libmodplug · debian · bookworm; dsa · libmodplug · debian · 12

    • 1:0.8.9.0-3 · arm64 · bookworm

      Fixed · Fixed: 1:0.8.7-1

      dsa · libmodplug · debian · bookworm; dsa · libmodplug · debian · 12

  • [libmodplug-dev]Fixed

    Source package: [libmodplug]

    Details (2)

    • 1:0.8.9.0-3 · amd64 · bookworm

      Fixed · Fixed: 1:0.8.7-1

      dsa · libmodplug · debian · bookworm; dsa · libmodplug · debian · 12

    • 1:0.8.9.0-3 · arm64 · bookworm

      Fixed · Fixed: 1:0.8.7-1

      dsa · libmodplug · debian · bookworm; dsa · libmodplug · debian · 12

[Debian 13 (Trixie)]

  • [libmodplug1]Fixed

    Source package: [libmodplug]

    Details (2)

    • 1:0.8.9.0-3+b2 · amd64 · trixie

      Fixed · Fixed: 1:0.8.7-1

      dsa · libmodplug · debian · 13

    • 1:0.8.9.0-3+b2 · arm64 · trixie

      Fixed · Fixed: 1:0.8.7-1

      dsa · libmodplug · debian · 13

  • [libmodplug-dev]Fixed

    Source package: [libmodplug]

    Details (2)

    • 1:0.8.9.0-3+b2 · amd64 · trixie

      Fixed · Fixed: 1:0.8.7-1

      dsa · libmodplug · debian · 13

    • 1:0.8.9.0-3+b2 · arm64 · trixie

      Fixed · Fixed: 1:0.8.7-1

      dsa · libmodplug · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]