Summary
It was discovered that mpg123 incorrectly handled certain mp3 files. If a
user or automated system were tricked into opening a specially crafted mp3
file, a remote attacker could use this issue to cause mpg123 to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | mpg123 | 1.25.13-1ubuntu0.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | mpg123 | 1.29.3-1ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | mpg123 | 1.32.5-1ubuntu1.1 |
Vulnerabilities 1
-
Medium 6.7
Mpg123: buffer overflow when writing decoded pcm samples
An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The compl…
References
-
report
https://ubuntu.com/security/CVE-2024-10573