openSUSE-SU-2026:22165-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22165-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22165-1
Upstream
CVE (4)
  • CVE-2026-108577
  • CVE-2026-111270
  • CVE-2026-111271
  • CVE-2026-75904
Related
CVE (4)
  • CVE-2026-108577
  • CVE-2026-111270
  • CVE-2026-111271
  • CVE-2026-75904
Published
2026-10-23T20:13:09Z
Modified
2026-10-24T16:45:03Z
Summary
Security update for libmodplug
Details

This update for libmodplug fixes the following issues:

Changes in libmodplug:

  • CVE-2026-108577: This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption [bsc#1284977]
  • CVE-2026-111270: a heap-based out-of-bounds write in CSoundFile:ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS [bsc#1285765]
  • CVE-2026-111271: a heap-based out-of-bounds read vulnerability in CSoundFile:ReadAMS2() in src/load_ams.cpp [bsc#1285766]
  • CVE-2026-75904: libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp [bsc#1275624]
References

Affected packages

openSUSE:Leap 16.0 / libmodplug

Package

Name
libmodplug
Purl
pkg:rpm/opensuse/libmodplug&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.9.0+git20170610.f6dd59a-bp160.2.1

Ecosystem specific 

{
    "binaries":  [
        {
            "libmodplug-devel":  "0.8.9.0+git20170610.f6dd59a-bp160.2.1",
            "libmodplug1":  "0.8.9.0+git20170610.f6dd59a-bp160.2.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22165-1.json"