mpg123: Buffer overflow — GLSA 200501-14

An attacker may be able to execute arbitrary code by way of specially crafted MP2 or MP3 files.

Affected packages

Background

mpg123 is a real-time MPEG audio player.

Description

mpg123 improperly parses frame headers in input streams.

Impact

By inducing a user to play a malicious file, an attacker may be able to exploit a buffer overflow to execute arbitrary code with the permissions of the user running mpg123.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-sound/mpg123-0.59s-r9"

References

• CAN-2004-0991
• Bugtraq Announcement

Release date
January 10, 2005

Latest revision
January 10, 2005: 01

Severity
normal

Exploitable
remote

Bugzilla entries

• 76862