Debian Security Advisory
DSA-411-1 mpg321 -- format string vulnerability
- Date Reported:
- 05 Jan 2004
- Affected Packages:
- mpg321
- Vulnerable:
- Yes
- Security database references:
- In the Bugtraq database (at SecurityFocus): BugTraq ID 9364.
In Mitre's CVE dictionary: CVE-2003-0969. - More information:
-
A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
For the current stable distribution (woody) this problem has been fixed in version 0.2.10.2.
For the unstable distribution (sid) this problem has been fixed in version 0.2.10.3.
We recommend that you update your mpg321 package.
- Fixed in:
-
Debian GNU/Linux 3.0 (woody)
- Source:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2.dsc
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2.tar.gz
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2.tar.gz
- Alpha:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_sparc.deb
MD5 checksums of the listed files are available in the original advisory.