Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.