CVE-2017-12797
Fixed in a distro release EPSS 1%
Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers to cause a denial of service via a crafted file, which triggers a heap-based buffer overflow.
Products: mpg123
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | mpg123 | 1.25.6-1 |
| Debian 13 | mpg123 | 1.25.6-1 |
| Debian 14 | mpg123 | 1.25.6-1 |
| Ubuntu Pro 14.04 LTS | mpg123 | 1.16.0-1ubuntu1.1+esm1 |
| Ubuntu Pro 14.04 LTS | mpg123 | 1.16.0-1ubuntu1.1+esm2 |
| Ubuntu Pro 16.04 LTS | mpg123 | 1.22.4-1ubuntu0.1+esm2 |