Buffer overflow in the get_dsmp function in loaders/masi_load.c in libxmp before 4.1.0 allows remote attackers to execute arbitrary code via a crafted MASI file.
https://bugzilla.redhat.com/show_bug.cgi?id=954658
http://www.securityfocus.com/bid/59355
http://www.openwall.com/lists/oss-security/2013/04/22/12
http://sourceforge.net/projects/xmp/files/libxmp/4.1.0/Changelog/view