Debian Security Advisory
DLA-655-1 mpg123 -- LTS security update
- Date Reported:
- 15 Oct 2016
- Security database references:
- In Mitre's CVE dictionary: CVE-2014-9497, CVE-2016-1000247.
- More information:
Several security vulnerabilities have been discovered in mpg123, an MPEG layer 1/2/3 audio decoder and player. An attacker could take advantage of these flaws to cause a denial of service against mpg123 or applications using the libmpg123 library with a carefully crafted input file.
Myautsai PAN discovered a flaw in the decoder initialization code of libmpg123. A specially crafted mp3 input file can be used to cause a buffer overflow, resulting in a denial of service.
Jerold Hoong discovered a flaw in the id3 tag processing code of libmpg123. A specially crafted mp3 input file could be used to cause a buffer over-read, resulting in a denial of service.
For Debian 7
Wheezy, these problems have been fixed in version 1.14.4-1+deb7u1.
We recommend that you upgrade your mpg123 packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS