PT-2024-9756 · Mpg123+8 · Mpg123+8

Marco Benatto · Published 2024-10-30 · Updated 2025-03-17 · CVE-2024-10573

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mpg123 (affected versions not specified)

Description An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2024:11193

ALSA-2024:11242

BDU:2024-11493

CESA-2024_11193

CVE-2024-10573

DLA-3967-1

DSA-5811-1

INFSA-2024_11193

INFSA-2024_11242

MGASA-2024-0358

OPENSUSE-SU-2024:14454-1

RHSA-2024:11193

RHSA-2024:11242

RHSA-2024_11193

RHSA-2024_11242

RLSA-2024:11242

USN-7092-1

USN-7092-2

Affected Products

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Ubuntu

Mpg123

References · 64

• https://ubuntu.com/security/notices/USN-7092-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-10573 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:11242 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7092-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:11242 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:11242 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10573 · Security Note
• https://bdu.fstec.ru/vul/2024-11493 · Security Note
• https://ubuntu.com/security/notices/USN-7092-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-10573 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-10573 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-11242.html · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-11242.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0358.html · Security Note