Debian Security Advisory

DSA-411-1 mpg321 -- format string vulnerability

Date Reported:
05 Jan 2004
Affected Packages:
Security database references:
In the Bugtraq database (at SecurityFocus): BugTraq ID 9364.
In Mitre's CVE dictionary: CVE-2003-0969.
More information:

A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).

For the current stable distribution (woody) this problem has been fixed in version

For the unstable distribution (sid) this problem has been fixed in version

We recommend that you update your mpg321 package.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Intel IA-32:
Intel IA-64:
Motorola 680x0:
Big endian MIPS:
Little endian MIPS:
IBM S/390:
Sun Sparc:

MD5 checksums of the listed files are available in the original advisory.