The OpenMPT/libopenmpt project released the latest stable libopenmpt version:

libopenmpt 0.4.2 (2019-01-22)

  • [Sec] DSM: Assertion failure during file parsing with debug STLs (r11209). (CVE-2019-14382)

  • [Sec] J2B: Assertion failure during file parsing with debug STLs (r11216). (CVE-2019-14383)

  • S3M: Allow volume change of OPL instruments after Note Cut.

The changelog for older versions can be found at https://lib.openmpt.org/doc/changelog.html .

Source code download links:

Documentation and binary downloads can be found at the libopenmpt website at https://lib.openmpt.org/libopenmpt/.

The OpenMPT/libopenmpt project also released an update to the old libopenmpt 0.3 stable branch:

libopenmpt 0.3.15 (2019-01-22)

  • [Sec] DSM: Assertion failure during file parsing with debug STLs (r11210). (CVE-2019-14382)
  • [Sec] J2B: Assertion failure during file parsing with debug STLs (r11217). (CVE-2019-14383)

Source code download links:

Documentation and binary downloads can be found at the libopenmpt website at https://lib.openmpt.org/libopenmpt/.

The OpenMPT/libopenmpt project also released an update to the old libopenmpt 0.2 stable branch:

libopenmpt 0.2.11253-beta37 (2019-01-22)

  • [Sec] DSM: Assertion failure during file parsing with debug STLs (r11211). (CVE-2019-14382)

  • [Sec] J2B: Assertion failure during file parsing with debug STLs (r11218). (CVE-2019-14383)

  • Do not apply Amiga playback heuristics to MOD files that have clearly been written with a PC tracker.
  • SFX: Work around bad conversions of the “Operation Stealth” soundtrack by turning pattern breaks into note stops.
  • MO3: Apply playback changes based on “ModPlug-made” header flag.

Source code download links:

The OpenMPT/libopenmpt project updated the following libopenmpt versions with security fixes:

libopenmpt-0.2.7561-beta20.5-p13 (2019-01-22)

  • r11262: [Sec] Assertion failure with debug STLs (J2B). (CVE-2019-14383)
  • r11261: [Sec] Assertion failure with debug STLs (DSM). (CVE-2019-14382)

The following individual patches fix the mentioned issues (these patches must all be applied sequentially on top of the original libopenmpt-0.2.7561-beta20.5 source release):

libopenmpt-0.2.7386-beta20.3-p16 (2019-01-22)

  • r11259: [Sec] Assertion failure with debug STLs (J2B). (CVE-2019-14383)
  • r11258: [Sec] Assertion failure with debug STLs (DSM). (CVE-2019-14382)

The following individual patches fix the mentioned issues (these patches must all be applied sequentially on top of the original libopenmpt-0.2.7386-beta20.3 source release):

The following libopenmpt versions are currently supported with security fixes by the OpenMPT/libopenmpt project:

  • 0.4.2
    • Current stable version.
    • Receives security updates.
    • Receives minor playback fixes.
  • 0.3.15
    • Old stable version.
    • Receives security updates.
    • Receives trivial bug fixes.
  • 0.2.11253-beta37
    • Old stable version.
    • Receives security updates.
    • Receives trivial bug fixes.
  • 0.2.7561-beta20.5-p13
    • Older stable version which is supported on Unix-like systems only.
    • Receives only security fixes.
  • 0.2.7386-beta20.3-p16
    • Older stable version which is supported on Unix-like systems only.
    • Receives only security fixes.
  • 0.5 (SVN trunk)
    • development
    • security updates
    • playback fixes
    • new features
    • new file formats

Please update to the newest versions.