Description
Buffer overflow in layer2.c in mpg123 0.59r and possibly mpg123 0.59s allows remote attackers to execute arbitrary code via a certain (1) mp3 or (2) mp2 file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mp3gain | 1.5.2-r2-6 | — |
| Debian 14 | mpg123 | 0.59r-16 | — |
| Debian 13 | mp3gain | 1.5.2-r2-6 | — |
| Debian 13 | mpg123 | 0.59r-16 | — |
| Debian 12 | mp3gain | 1.5.2-r2-6 | — |
| Debian 12 | mpg123 | 0.59r-16 | — |
| Debian 3.0 | mpg123 | 0.59r-13woody3 | DSA-564-1 |
Advisories 1
- DSA-564-1 mpg123 - missing user input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20040916 mpg123 buffer overflow vulnerability mailing-list
- 11121 vdb-entry
- MDKSA-2004:100 vendor-advisory
- 20040907 mpg123 buffer overflow vulnerability mailing-list
- DSA-564 vendor-advisory
- GLSA-200409-20 vendor-advisory
- mpg123-layer2c-bo(17287) vdb-entry
- http://www.alighieri.org/advisories/advisory-mpg123.txt