CVE-2017-12839
Published: 9 May 2019
A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a possible denial-of-service (out-of-bounds read) or possibly have unspecified other impact via a crafted mp3 file.
From the Ubuntu Security Team
It was discovered that mpg123 failed to handle certain malformed mp3 files. An attacker could use this vulnerability to potentially leak sensitive information or cause a crash.
Notes
| Author | Note |
|---|---|
| msalvatore |
unable to reproduce the bug with ASAN in trusty or xenial. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
mpg123
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(1.25.10-1)
|
| cosmic |
Not vulnerable
(1.25.10-1)
|
|
| disco |
Not vulnerable
(1.25.10-1)
|
|
| eoan |
Not vulnerable
(1.25.10-1)
|
|
| focal |
Not vulnerable
(1.25.10-1)
|
|
| groovy |
Not vulnerable
(1.25.10-1)
|
|
| hirsute |
Not vulnerable
(1.25.10-1)
|
|
| impish |
Not vulnerable
(1.25.10-1)
|
|
| jammy |
Not vulnerable
(1.25.10-1)
|
|
| trusty |
Released
(1.16.0-1ubuntu1.1+esm2)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Released
(1.25.6-1)
|
|
| xenial |
Released
(1.22.4-1ubuntu0.1+esm2)
Available with Ubuntu Pro |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.3 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | Low |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L |