mpg123 MP3 Decoding Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	65304
Class:	Boundary Condition Error
CVE:	CVE-2014-9497
Remote:	Yes
Local:	No
Published:	Jan 31 2014 12:00AM
Updated:	Feb 16 2015 01:03AM
Credit:	PAN Myautsai
Vulnerable:	HP Insight Control 0 Gentoo Linux
Not Vulnerable:

mpg123 MP3 Decoding Heap Based Buffer Overflow Vulnerability

The 'mpg123' application is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data.

An attacker can exploit this issue to execute arbitrary code in the context of a user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to 1.18.0 are vulnerable.

mpg123 MP3 Decoding Heap Based Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

mpg123 MP3 Decoding Heap Based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

mpg123 MP3 Decoding Heap Based Buffer Overflow Vulnerability

References:

• mpg123 Home Page (mpg123)
  
• New Version announcement (mpg123)