The OpenMPT/libopenmpt project released the latest stable libopenmpt version:

libopenmpt 0.3.9 (2018-04-29)

  • [Sec] Possible write near address 0 in out-of-memory situations when reading AMS files (r10149). (CVE-2018-11710)

  • [Bug] openmpt123: Fixed build failure in C++17 due to use of removed feature std::random_shuffle.

  • STM: Having both Bxx and Cxx commands in a pattern imported the Bxx command incorrectly.
  • STM: Last character of sample name was missing.
  • Speed up reading of truncated ULT files.
  • ULT: Portamento import was sometimes broken.
  • The resonant filter was sometimes unstable when combining low-volume samples, low cutoff and high mixing rates.

The changelog for older versions can be found at https://lib.openmpt.org/doc/changelog.html .

Source code download links:

Documentation and binary downloads can be found at the libopenmpt website at https://lib.openmpt.org/libopenmpt/.

The OpenMPT/libopenmpt project also released an update to the old libopenmpt 0.2 stable branch:

libopenmpt 0.2.10172-beta32 (2018-04-29)

  • [Sec] Possible write near address 0 in out-of-memory situations when reading AMS files (r10151, r10154). (CVE-2018-11710)

  • STM: Having both Bxx and Cxx commands in a pattern imported the Bxx command incorrectly.
  • STM: Last character of sample name was missing.
  • Speed up reading of truncated ULT files.
  • ULT: Portamento import was sometimes broken.

Source code download links:

The OpenMPT/libopenmpt project updated the following libopenmpt versions with security fixes:

libopenmpt-0.2.7561-beta20.5-p9 (2018-04-29)

  • r10165: [Sec] Null-pointer dereference write after out-of-memory (AMS). (CVE-2018-11710)

The following individual patches fix the mentioned issues (these patches must all be applied sequentially on top of the original libopenmpt-0.2.7561-beta20.5 source release):

libopenmpt-0.2.7386-beta20.3-p12 (2018-04-29)

  • r10167: [Sec] Null-pointer dereference write after out-of-memory (AMS). (CVE-2018-11710)

The following individual patches fix the mentioned issues (these patches must all be applied sequentially on top of the original libopenmpt-0.2.7386-beta20.3 source release):

The following libopenmpt versions are currently supported with security fixes by the OpenMPT/libopenmpt project:

  • 0.3.9
    • Current stable version.
    • Receives security updates.
    • Receives minor playback fixes.
  • 0.2.10049-beta32
    • Old stable version.
    • Receives security updates.
    • Receives trivial bug fixes.
  • 0.2.7561-beta20.5-p9
    • Older stable version which is supported on Unix-like systems only.
    • Receives only security fixes.
  • 0.2.7386-beta20.3-p12
    • Older stable version which is supported on Unix-like systems only.
    • Receives only security fixes.
  • 0.4 (SVN trunk)
    • development
    • security updates
    • playback fixes
    • new features
    • new file formats

Please update to the newest versions.