PatchTheCVEmpg123 vulnerabilities
Recent CVEs affecting mpg123 products. 6 tracked.
mpg123 has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2019-05-09. Highest priority: CVE-2017-12839 (score 56/100).
- CVE-2017-9545 MEDIUM 5.5 DOWNGRADE The next_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows remote attackers to cause a denial of se
- CVE-2017-12839 HIGH 8.3 UPGRADE A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allo
- CVE-2017-12797 MEDIUM 5.5 UPGRADE Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit plat
- CVE-2017-11126 MEDIUM 5.5 UPGRADE The III_i_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause a de
- CVE-2017-10683 HIGH 7.5 DOWNGRADE In mpg123 1.25.0, there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c
- CVE-2014-9497 HIGH 7.5 UPGRADE Buffer overflow in mpg123 before 1.18.0.
FAQ
How do I fix mpg123 vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mpg123 being exploited right now?
None of the tracked mpg123 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mpg123 CVE should I patch first?
CVE-2017-12839 currently ranks highest (56/100): A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allo.