CVE-2024-10573

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-10573
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10573.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-10573
Related
Published
2024-10-31T19:15:12Z
Modified
2024-12-05T15:36:07.313819Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

References

Affected packages

Alpine:v3.21 / mpg123

Package

Name
mpg123
Purl
pkg:apk/alpine/mpg123?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.32.8-r0

Affected versions

1.*

1.6.4-r0
1.7.2-r0
1.7.3-r0
1.8.1-r0
1.8.1-r1
1.9.0-r0
1.10.0-r0
1.10.1-r0
1.12.1-r0
1.12.1-r1
1.12.3-r0
1.13.1-r0
1.13.2-r0
1.13.3-r0
1.13.4-r0
1.13.6-r0
1.13.8-r0
1.14.1-r0
1.14.2-r0
1.14.3-r0
1.14.4-r0
1.15.1-r0
1.15.3-r0
1.15.4-r0
1.16.0-r0
1.16.0-r1
1.17.0-r0
1.18.0-r0
1.18.1-r0
1.19.0-r0
1.20.0-r0
1.20.1-r0
1.21.0-r0
1.22.0-r0
1.22.1-r0
1.22.3-r0
1.22.4-r0
1.23.1-r0
1.23.3-r0
1.23.5-r0
1.23.6-r0
1.23.7-r0
1.23.8-r0
1.24.0-r0
1.25.0-r0
1.25.1-r0
1.25.2-r0
1.25.4-r0
1.25.5-r0
1.25.6-r0
1.25.7-r0
1.25.8-r0
1.25.10-r0
1.25.11-r0
1.25.12-r0
1.25.13-r0
1.26.0-r0
1.26.1-r0
1.26.2-r0
1.26.3-r0
1.26.3-r1
1.26.4-r0
1.26.5-r0
1.27.0-r0
1.27.2-r0
1.28.0-r0
1.28.1-r0
1.28.2-r0
1.29.0-r0
1.29.1-r0
1.29.2-r0
1.29.3-r0
1.30.0-r0
1.30.1-r0
1.30.2-r0
1.31.0-r0
1.31.1-r0
1.31.2-r0
1.31.2-r1
1.31.3-r0
1.31.3-r1
1.32.1-r0
1.32.2-r0
1.32.3-r0
1.32.4-r0
1.32.5-r0
1.32.6-r0
1.32.7-r0

Debian:11 / mpg123

Package

Name
mpg123
Purl
pkg:deb/debian/mpg123?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.26.4-1+deb11u1

Affected versions

1.*

1.26.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / mpg123

Package

Name
mpg123
Purl
pkg:deb/debian/mpg123?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.31.2-1+deb12u1

Affected versions

1.*

1.31.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / mpg123

Package

Name
mpg123
Purl
pkg:deb/debian/mpg123?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.32.8-1

Affected versions

1.*

1.31.2-1
1.31.3-1
1.31.3-2
1.32.3-1
1.32.4-1
1.32.4-1.1~exp1
1.32.5-1
1.32.6-1
1.32.6-2
1.32.6-3
1.32.7-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}