CVE-2006-1655

Name	CVE-2006-1655
Description	Multiple buffer overflows in mpg123 0.59r allow user-assisted attackers to trigger a segmentation fault and possibly have other impacts via a certain MP3 file, as demonstrated by mpg1DoS3. NOTE: this issue might be related to CVE-2004-0991, but it is not clear.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1074-1
Debian Bugs	361863

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mp3gain (PTS)	sid, trixie, bullseye, bookworm	1.6.2-2	fixed
mpg123 (PTS)	jessie	1.20.1-2+deb8u1	fixed
	stretch	1.23.8-1	fixed
	buster	1.25.10-2	fixed
	bullseye	1.26.4-1	fixed
	bookworm	1.31.2-1	fixed
	bookworm (security)	1.31.2-1+deb12u1	fixed
	sid, trixie	1.32.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mp3gain	source	wheezy	1.5.2-r2-2+deb7u1
mp3gain	source	(unstable)	1.5.2-r2-6	low
mpg123	source	sarge	0.59r-20sarge1		DSA-1074-1
mpg123	source	(unstable)	0.59r-22			361863

[squeeze] - mp3gain <no-dsa> (Minor issue)