FKIE_CVE-2010-2971

Vulnerability from fkie_nvd - Published: 2010-08-05 13:22 - Updated: 2026-06-16 23:21
Severity
Summary
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
References
cve@mitre.orghttp://secunia.com/advisories/48244
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-201203-10.xml
cve@mitre.orghttp://sourceforge.net/tracker/?func=detail&aid=3033086&group_id=40531&atid=428227
cve@mitre.orghttp://www.debian.org/security/2010/dsa-2081
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2010:151
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=614643
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/48244
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-201203-10.xml
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/tracker/?func=detail&aid=3033086&group_id=40531&atid=428227
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2010/dsa-2081
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=614643
Impacted products
Vendor Product Version
raphael_assenat libmikmod 3.1.12
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:raphael_assenat:libmikmod:3.1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EB33FA6-1F1A-4255-B468-19036B180C29",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546.  NOTE: this issue exists because of an incomplete fix for CVE-2009-3995."
    },
    {
      "lang": "es",
      "value": "oaders/load_it.c en libmikmod, posiblemente v3.1.12, no considera adecuadamente los tama\u00f1os grandes de name##env en relaci\u00f3n con name##tick y name##node, lo cual permite a atacantes remotos disparar una sobre-lectura de b\u00fafer y posiblemente tener otros impactos no especificados a trav\u00e9s de ficheros Impulse Tracker manipulados, relacionado con el comportamiento de CVE-2010-2546. OTA: esta vulnerabilidad existe debido a una soluci\u00f3n incompleta de CVE-2009-3995."
    }
  ],
  "id": "CVE-2010-2971",
  "lastModified": "2026-06-16T23:21:51.900",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2010-08-05T13:22:29.997",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/48244"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-201203-10.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sourceforge.net/tracker/?func=detail\u0026aid=3033086\u0026group_id=40531\u0026atid=428227"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2010/dsa-2081"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:151"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=614643"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/48244"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-201203-10.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sourceforge.net/tracker/?func=detail\u0026aid=3033086\u0026group_id=40531\u0026atid=428227"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2010/dsa-2081"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:151"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=614643"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.