Debian Long Term Support / LTS Security Information / 2016 / Security Information -- DLA-655-1 mpg123

Debian Security Advisory

DLA-655-1 mpg123 -- LTS security update

Date Reported:

15 Oct 2016

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2014-9497, CVE-2016-1000247.

More information:

Several security vulnerabilities have been discovered in mpg123, an MPEG layer 1/2/3 audio decoder and player. An attacker could take advantage of these flaws to cause a denial of service against mpg123 or applications using the libmpg123 library with a carefully crafted input file.

• CVE-2014-9497

  Myautsai PAN discovered a flaw in the decoder initialization code of libmpg123. A specially crafted mp3 input file can be used to cause a buffer overflow, resulting in a denial of service.

• CVE-2016-1000247

  Jerold Hoong discovered a flaw in the id3 tag processing code of libmpg123. A specially crafted mp3 input file could be used to cause a buffer over-read, resulting in a denial of service.

For Debian 7 Wheezy, these problems have been fixed in version 1.14.4-1+deb7u1.

We recommend that you upgrade your mpg123 packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS