CVE-2004-0982 Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users to execute arbitrary code via an mp3 file that contains a lo...
HighCVSS 10.0
EPSS 6.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users to execute arbitrary code via an mp3 file that contains a long string before the @ (at sign) in a URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mpg123 | = 0.59r | No fix listed |
| mpg123 | = pre0.59s | No fix listed |
| debian/mpg123(Debian:12) | < 0.59r-18 | 0.59r-18 |
| debian/mpg123(Debian:13) | < 0.59r-18 | 0.59r-18 |
| debian/mpg123(Debian:14) | < 0.59r-18 | 0.59r-18 |
References
- 20041019 mpg123 "getauthfromurl" buffer overflow mailing-list
- 12908 third-party-advisory
- 1011832 vdb-entry
- www.barrossecurity.com
- DSA-578 patch vendor-advisory
- GLSA-200410-27 vendor-advisory
- 11023 vdb-entry
- 11468 patch vdb-entry vendor-advisory
- mpg123-getauthfromurl-bo(17574) vdb-entry
- Debian Security Tracker CVE-2004-0982 vendor-advisory