CVE-2010-2546

Name of the Vulnerable Software and Affected Versions libmikmod versions prior to 3.2.0 beta2-r3

Description The issue is related to multiple heap-based buffer overflows in the loaders/load it.c file of libmikmod. This could potentially allow remote attackers to execute arbitrary code via crafted samples or instrument definitions in an Impulse Tracker file. The IT ProcessEnvelope function, as well as panpts and pitpts, are related to this issue.

Recommendations For versions prior to 3.2.0 beta2-r3, update to version 3.2.0 beta2-r3 or later to resolve the issue. As a temporary workaround, consider restricting access to the loaders/load it.c file or disabling the IT ProcessEnvelope function until a patch is available.