Updated libxmp packages fix security vulnerabilities
Publication date: 10 Jun 2026Modification date: 10 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-45676 , CVE-2023-45677 , CVE-2023-45679 , CVE-2023-45680 , CVE-2023-45681 , CVE-2023-45682 , CVE-2025-47256
Description
CVE-2023-45679: Attempt to free an uninitialized memory pointer in
vorbis_deinit()
CVE-2023-45680: Null pointer dereference in vorbis_deinit()
CVE-2023-45681: Out of bounds heap buffer write
CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder()
CVE-2023-45677: Heap buffer out of bounds write in start_decoder()
CVE-2023-45682: Wild address read in vorbis_decode_packet_rest()
CVE-2025-47256 stack-based buffer overflow in depack_pha in
loaders/prowizard/pha.c via a malformed Pha format tracker module in a
.mod file.
References
- https://bugs.mageia.org/show_bug.cgi?id=33915
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVZWMTH36ES7RCJEMRANBDTL76QBE75Z/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKMOFYKVMD2LPU7O33SEH2RGSY2ZE73K/
- https://www.cve.org/CVERecord?id=CVE-2023-45676
- https://www.cve.org/CVERecord?id=CVE-2023-45677
- https://www.cve.org/CVERecord?id=CVE-2023-45679
- https://www.cve.org/CVERecord?id=CVE-2023-45680
- https://www.cve.org/CVERecord?id=CVE-2023-45681
- https://www.cve.org/CVERecord?id=CVE-2023-45682
- https://www.cve.org/CVERecord?id=CVE-2025-47256
SRPMS
9/core
- libxmp-4.5.0-2.1.mga9