CVE-2024-10573

Name	CVE-2024-10573
Description	An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3967-1, DSA-5811-1, ELA-1250-1, ELA-1251-1
Debian Bugs	1086443

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mpg123 (PTS)	jessie	1.20.1-2+deb8u1	vulnerable
	stretch (lts), stretch	1.23.8-1+deb9u1	fixed
	buster, buster (lts)	1.25.10-2+deb10u1	fixed
	bullseye	1.26.4-1	vulnerable
	bullseye (security)	1.26.4-1+deb11u1	fixed
	bookworm	1.31.2-1	vulnerable
	bookworm (security)	1.31.2-1+deb12u1	fixed
	sid, trixie	1.32.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mpg123	source	jessie	(unfixed)	end-of-life
mpg123	source	stretch	1.23.8-1+deb9u1		ELA-1251-1
mpg123	source	buster	1.25.10-2+deb10u1		ELA-1250-1
mpg123	source	bullseye	1.26.4-1+deb11u1		DLA-3967-1
mpg123	source	bookworm	1.31.2-1+deb12u1		DSA-5811-1
mpg123	source	(unstable)	1.32.8-1			1086443

https://www.openwall.com/lists/oss-security/2024/10/30/2
https://sourceforge.net/p/mpg123/bugs/322/