vgmstream vulnerabilities

A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta/awb.c of the component AWB parser. Such manipulation leads to divide by zero. The attack can be executed remotely. The name of the patch is ae37662ad626254ddd96ad69ac263792d7a92024. A patch should be applied to remediate this issue.

In vgmstream up to r2117, the vadpcm_read_coefs_be function in src/coding/vadpcm_decoder.c (EA SCHl parser component) mishandles the entry/entries argument, causing an out-of-bounds write. Remote exploitation is possible. A patch named ae37662ad626254ddd96ad69ac263792d7a92024 is available.

A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad626254ddd96ad69ac263792d7a92024.

A vulnerability in vgmstream up to r2117 affects the add_entry function in src/meta/txtp_parser.c in the txtp component. Manipulation of range_start/range_end arguments leads to resource consumption. The attack can be performed remotely, and the exploit has been disclosed publicly. The patch is named 4b6a02dd1aff6428255db912563d77d4cb0a143e.

A weakness in vgmstream up to r2117 affects the sscanf function in src/meta/txth.c in the txth-txtp component. This manipulation causes stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been made public. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b.