Description
Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users to execute arbitrary code via an mp3 file that contains a long string before the @ (at sign) in a URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mpg123 | 0.59r-18 | — |
| Debian 13 | mpg123 | 0.59r-18 | — |
| Debian 12 | mpg123 | 0.59r-18 | — |
| Debian 3.0 | mpg123 | 0.59r-13woody4 | DSA-578-1 |
Advisories 1
- DSA-578-1 mpg123 - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.barrossecurity.com/advisories/mpg123_getauthfromurl_bof_advisory.txt
- 1011832 vdb-entry
- 12908 third-party-advisory
- GLSA-200410-27 vendor-advisory
- 20041019 mpg123 "getauthfromurl" buffer overflow mailing-list
- 11023 vdb-entry
- mpg123-getauthfromurl-bo(17574) vdb-entry
- 11468 vdb-entry
- DSA-578 vendor-advisory