Summary
The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries.
Security Fix(es):
* mpg123: Buffer overflow when writing decoded PCM samples (CVE-2024-10573)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | mpg123 | 1.32.9-1.el8_10 |
| AlmaLinux · 8 | mpg123-devel | 1.32.9-1.el8_10 |
| AlmaLinux · 8 | mpg123-libs | 1.32.9-1.el8_10 |
| AlmaLinux · 8 | mpg123-plugins-pulseaudio | 1.32.9-1.el8_10 |
Vulnerabilities 1
-
Medium 6.7
Mpg123: buffer overflow when writing decoded pcm samples
An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The compl…