Register | Log in

adplug

Choose email to subscribe with

general

source: adplug (main)
version: 2.4+dfsg-2
maintainer: Yangfl (DMD)
arch: any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.3.3+dfsg-2
oldstable: 2.3.3+dfsg-2
stable: 2.3.3+dfsg-2
testing: 2.4+dfsg-2
unstable: 2.4+dfsg-2

versioned links

2.3.3+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

adplug-utils
libadplug-2.4-0
libadplug-dev

action needed

3 security issues in trixie high

There are 3 open security issues in trixie.

3 important issues:

CVE-2026-110875: AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
CVE-2026-110876: AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may crash affected applications.
CVE-2026-110877: AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.

Created: 2026-10-16 Last update: 2026-10-16 08:33

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2026-110875: AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
CVE-2026-110876: AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may crash affected applications.
CVE-2026-110877: AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.

Created: 2026-10-16 Last update: 2026-10-16 08:33

3 security issues in forky high

There are 3 open security issues in forky.

3 important issues:

CVE-2026-110875: AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
CVE-2026-110876: AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may crash affected applications.
CVE-2026-110877: AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.

Created: 2026-10-16 Last update: 2026-10-16 08:33

3 security issues in bookworm high

There are 3 open security issues in bookworm.

3 important issues:

CVE-2026-110875: AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
CVE-2026-110876: AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may crash affected applications.
CVE-2026-110877: AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.

Created: 2026-10-16 Last update: 2026-10-16 08:33

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 2.4+dfsg-2 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-12-30 08:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2020-11-17 Last update: 2026-03-31 15:01

news

[2026-01-04] adplug 2.4+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-12-29] Accepted adplug 2.4+dfsg-2 (source) into unstable (Yangfl) (signed by: Boyuan Yang)
[2025-12-08] adplug 2.3.3+dfsg-2.1 MIGRATED to testing (Debian testing watch)
[2025-12-04] Accepted adplug 2.4+dfsg-1 (source amd64) into experimental (Debian FTP Masters) (signed by: Boyuan Yang)
[2025-12-03] Accepted adplug 2.3.3+dfsg-2.1 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2020-07-24] adplug 2.3.3+dfsg-2 MIGRATED to testing (Debian testing watch)
[2020-07-17] Accepted adplug 2.3.3+dfsg-2 (source) into unstable (Yangfl) (signed by: Boyuan Yang)
[2020-06-23] Accepted adplug 2.3.3+dfsg-1 (source amd64) into experimental, experimental (Debian FTP Masters) (signed by: Boyuan Yang)
[2020-06-10] Accepted adplug 2.3.2+dfsg-1 (source amd64) into experimental, experimental (Debian FTP Masters) (signed by: Boyuan Yang)
[2019-10-22] adplug 2.3.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-10-16] Accepted adplug 2.3.1+dfsg-2 (source) into unstable (Yangfl) (signed by: Boyuan Yang)
[2019-10-13] Accepted adplug 2.3.1+dfsg-1 (source amd64) into experimental, experimental (Yangfl) (signed by: Boyuan Yang)
[2019-09-16] adplug REMOVED from testing (Debian testing watch)
[2019-01-10] adplug 2.2.1+dfsg3-1 MIGRATED to testing (Debian testing watch)
[2019-01-04] Accepted adplug 2.2.1+dfsg3-1 (source amd64) into unstable (Moritz Muehlenhoff) (signed by: Moritz Mühlenhoff)
[2018-10-07] Accepted adplug 2.2.1+dfsg3-0.1+deb8u1 (source amd64) into oldstable (Chris Lamb)
[2017-03-13] adplug 2.2.1+dfsg3-0.4 MIGRATED to testing (Debian testing watch)
[2017-03-07] Accepted adplug 2.2.1+dfsg3-0.4 (source amd64) into unstable (John Paul Adrian Glaubitz)
[2015-09-07] adplug 2.2.1+dfsg3-0.3 MIGRATED to testing (Britney)
[2015-08-24] Accepted adplug 2.2.1+dfsg3-0.3 (amd64 source) into unstable, unstable (Simon McVittie)
[2015-05-28] adplug 2.2.1+dfsg3-0.2 MIGRATED to testing (Britney)
[2015-05-23] Accepted adplug 2.2.1+dfsg3-0.2 (source amd64) into unstable (Wookey)
[2013-02-10] adplug 2.2.1+dfsg3-0.1 MIGRATED to testing (Debian testing watch)
[2013-01-30] Accepted adplug 2.2.1+dfsg3-0.1 (source amd64) (gregor herrmann)
[2013-01-03] adplug 2.2.1+dfsg2-1.1 MIGRATED to testing (Debian testing watch)
[2012-12-23] Accepted adplug 2.2.1+dfsg2-1.1 (source amd64) (Jelmer Vernooij)
[2011-06-17] adplug 2.2.1+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2011-05-29] Accepted adplug 2.2.1+dfsg1-1 (source amd64) (Артём Попов) (signed by: Ralf Treinen)
[2009-08-07] adplug 2.0.1.dfsg-1 MIGRATED to testing (Debian testing watch)
[2009-07-27] Accepted adplug 2.0.1.dfsg-1 (source i386) (Chris Lamb)

1
2

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.4+dfsg-2

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing