Critical Out-of-Bounds Write Vulnerability in mpg123: Potential for Heap Corruption
Summary
CVE-2024-10573: An out-of-bounds write flaw was found in mpg123 when handling crafted streams. Affects mpg123 versions < 1.32.8-r0. Fixed in 1.32.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mpg123 is a widely used audio player for MPEG audio streams, known for its efficiency and support for various audio formats. It is commonly utilized in both desktop and server environments for streaming audio content. However, a critical vulnerability has been identified that affects its ability to handle crafted streams, leading to potential security risks.
Vulnerability Detail
An out-of-bounds write flaw exists in mpg123 when processing specially crafted audio streams. This vulnerability allows the libmpg123 library to write beyond the allocated memory buffer on the heap, which can lead to heap corruption. The exploitation of this vulnerability is complex, requiring the attacker to craft a payload that is validated by the MPEG decoder and the PCM synthesizer before execution. Furthermore, the user must interact with the stream, making exploitation through web live streams, such as web radios, a less likely attack vector. The CVSS score for this vulnerability is 6.7, indicating a moderate level of risk.
How To Fix
Minimum fixed version
1.32.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade mpg123Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using mpg123 for streaming audio from untrusted sources until the package is updated. Additionally, consider using alternative audio players that do not exhibit this vulnerability.
Conclusion
The out-of-bounds write vulnerability in mpg123 poses significant risks, including heap corruption and potential arbitrary code execution. Users are advised to update to the latest version of mpg123 to mitigate these risks. Until an update can be applied, it is recommended to avoid using the software for untrusted audio streams.
See every vulnerability recorded for mpg123 →
FAQ
The vulnerability is an out-of-bounds write flaw that can lead to heap corruption and potential arbitrary code execution.
If you are using mpg123 version 0 or later on Debian 11, 12, or 13, your version is affected by this vulnerability.
As a workaround, avoid using mpg123 for streaming audio from untrusted sources until you can update to a patched version.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 6.7, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for mpg123.
