Threats affecting pkg:github/tildearrow/furnace

Furnace versions up to 0.6.8.3 have an out-of-bounds write vulnerability in the DivEngine::loadFTM() function. This flaw allows attackers to corrupt heap memory by using an unchecked subsong index in the GROOVES block of a crafted FamiTracker module. Specifically, a subsong count of 2 or more can cause a groove pattern to be written past the subsong vector, leading to a crash when Furnace opens the module.

Furnace versions up to 0.6.8.3 have an out-of-bounds heap read vulnerability in the DivEngine::loadFTM() function. This flaw occurs when importing FamiTracker modules with a crafted instrument note count exceeding 120, causing the application to read beyond the noteMap array and crash. The vulnerability affects .ftm, .dnm, and 0CC/E-FamiTracker module files.

Out-of-bounds Read vulnerability in tildearrow furnace (‎extern/libsndfile-modified/src modules). This vulnerability is associated with program files flac.C‎. This issue affects furnace: before 0.7.

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associated with program files inflate.C.