Security Update for mpg123
Summary
DLA-655-1: mpg123 - security update. Affects mpg123 versions < 1.14.4-1+deb7u1. Fixed in 1.14.4-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mpg123 is an MPEG layer 1/2/3 audio decoder and player. It is used to decode and play audio files in the MP3 format. The mpg123 library is commonly used by various applications to handle MP3 files. However, several security vulnerabilities have been discovered in mpg123, which could be exploited by an attacker to cause a denial of service (DoS) attack. These vulnerabilities affect the libmpg123 library and can be triggered by specially crafted MP3 input files.
Vulnerability Detail
The first vulnerability, identified as CVE-2014-9497, involves a flaw in the decoder initialization code of libmpg123. By providing a specially crafted MP3 file, an attacker can trigger a buffer overflow, leading to a DoS condition. The second vulnerability, known as CVE-2016-1000247, is related to the id3 tag processing code of libmpg123. An attacker can exploit this flaw by supplying a malicious MP3 file, causing a buffer over-read and resulting in a DoS. These vulnerabilities can be leveraged to disrupt the functionality of mpg123 or any application utilizing the libmpg123 library.
How To Fix
Minimum fixed version
1.14.4-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mpg123Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to apply the provided security update to mitigate the risks associated with these flaws.
Conclusion
In conclusion, mpg123 is susceptible to two security vulnerabilities that can be exploited to cause a denial of service (DoS) attack. To protect your system, it is crucial to upgrade the mpg123 packages to version 1.14.4-1+deb7u1 or later. This update includes fixes for the identified vulnerabilities. For further assistance or support regarding vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mpg123 →
FAQ
mpg123 is an MPEG layer 1/2/3 audio decoder and player. It is commonly used to decode and play MP3 audio files.
There are two vulnerabilities in mpg123: CVE-2014-9497 and CVE-2016-1000247. These vulnerabilities can be exploited by an attacker to cause a denial of service (DoS) by providing specially crafted MP3 files.
The vulnerabilities in mpg123 can be leveraged to cause a denial of service (DoS) against mpg123 itself or any application using the libmpg123 library. This can result in the disruption of audio playback or other functionality relying on mpg123.
To fix these vulnerabilities, it is recommended to upgrade the mpg123 packages to version 1.14.4-1+deb7u1 or later. This update includes patches that address the identified security flaws.
No, there are no known workarounds for these vulnerabilities. It is essential to apply the provided security update to mitigate the risks.
Related vulnerabilities
Recent vulnerabilities recorded for mpg123.
