PT-2019-7930 · Mpg123+2 · Mpg123+2

Published 2017-08-16 · Updated 2021-03-17 · CVE-2017-12839

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions mpg123 versions 1.25.5 and earlier

Description A heap-based buffer over-read issue exists in the getbits function, potentially allowing remote attackers to cause a denial-of-service or have other unspecified impacts via a crafted mp3 file.

Recommendations For versions 1.25.5 and earlier, update to a version later than 1.25.5 to resolve the issue.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2017-2067

CVE-2017-12839

USN-4806-1

Affected Products

Alt Linux

Ubuntu

Mpg123

References · 15

• 🔥 https://sourceforge.net/p/mpg123/bugs/255 · Exploit
• https://ubuntu.com/security/CVE-2017-12839 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4806-1 · Vendor Advisory
• https://mpg123.de · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-12839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12839 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12839 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12797 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-12839 · Security Note
• https://mpg123.de/cgi-bin/scm/mpg123/trunk/src/libmpg123/getbits.h?r1=2024&r2=4323&sortby=date · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9545 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11126 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12839 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12839 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4806-1 · Vendor Advisory