UBUNTU-CVE-2024-10573

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2024-10573

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-10573.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-10573

Related

Published

2024-10-30T00:00:00Z

Modified

2024-12-18T16:41:27Z

Severity

6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

References

Affected packages

Ubuntu:Pro:14.04:LTS / mpg123

Package

Name: mpg123
Purl: pkg:deb/ubuntu/mpg123?arch=src?distro=esm-infra-legacy/trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.15.3-1ubuntu1

1.16.0-1ubuntu1

1.16.0-1ubuntu1.1

1.16.0-1ubuntu1.1+esm2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / mpg123

Package

Name: mpg123
Purl: pkg:deb/ubuntu/mpg123?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.22.2-1

1.22.4-1

1.22.4-1ubuntu0.1

1.22.4-1ubuntu0.1+esm2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / mpg123

Package

Name: mpg123
Purl: pkg:deb/ubuntu/mpg123?arch=src?distro=esm-infra/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.25.6-1

1.25.7-1

1.25.8-1

1.25.10-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / mpg123

Package

Name: mpg123
Purl: pkg:deb/ubuntu/mpg123?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.25.13-1ubuntu0.2

Affected versions

1.*

1.25.12-1build1

1.25.13-1

1.25.13-1ubuntu0.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.25.13-1ubuntu0.2",
            "binary_name": "libmpg123-0"
        },
        {
            "binary_version": "1.25.13-1ubuntu0.2",
            "binary_name": "libmpg123-0-dbgsym"
        },
        {
            "binary_version": "1.25.13-1ubuntu0.2",
            "binary_name": "libmpg123-dev"
        },
        {
            "binary_version": "1.25.13-1ubuntu0.2",
            "binary_name": "libout123-0"
        },
        {
            "binary_version": "1.25.13-1ubuntu0.2",
            "binary_name": "libout123-0-dbgsym"
        },
        {
            "binary_version": "1.25.13-1ubuntu0.2",
            "binary_name": "mpg123"
        },
        {
            "binary_version": "1.25.13-1ubuntu0.2",
            "binary_name": "mpg123-dbgsym"
        }
    ]
}

Ubuntu:22.04:LTS / mpg123

Package

Name: mpg123
Purl: pkg:deb/ubuntu/mpg123?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.29.3-1ubuntu0.1

Affected versions

1.*

1.28.2-2

1.29.2-1

1.29.3-1

1.29.3-1build1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.29.3-1ubuntu0.1",
            "binary_name": "libmpg123-0"
        },
        {
            "binary_version": "1.29.3-1ubuntu0.1",
            "binary_name": "libmpg123-0-dbgsym"
        },
        {
            "binary_version": "1.29.3-1ubuntu0.1",
            "binary_name": "libmpg123-dev"
        },
        {
            "binary_version": "1.29.3-1ubuntu0.1",
            "binary_name": "libout123-0"
        },
        {
            "binary_version": "1.29.3-1ubuntu0.1",
            "binary_name": "libout123-0-dbgsym"
        },
        {
            "binary_version": "1.29.3-1ubuntu0.1",
            "binary_name": "libsyn123-0"
        },
        {
            "binary_version": "1.29.3-1ubuntu0.1",
            "binary_name": "libsyn123-0-dbgsym"
        },
        {
            "binary_version": "1.29.3-1ubuntu0.1",
            "binary_name": "mpg123"
        },
        {
            "binary_version": "1.29.3-1ubuntu0.1",
            "binary_name": "mpg123-dbgsym"
        }
    ]
}

Ubuntu:24.10 / mpg123

Package

Name: mpg123
Purl: pkg:deb/ubuntu/mpg123?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.32.7-1ubuntu0.1

Affected versions

1.*

1.32.5-1ubuntu1

1.32.6-3

1.32.7-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.32.7-1ubuntu0.1",
            "binary_name": "libmpg123-0t64"
        },
        {
            "binary_version": "1.32.7-1ubuntu0.1",
            "binary_name": "libmpg123-0t64-dbgsym"
        },
        {
            "binary_version": "1.32.7-1ubuntu0.1",
            "binary_name": "libmpg123-dev"
        },
        {
            "binary_version": "1.32.7-1ubuntu0.1",
            "binary_name": "libout123-0t64"
        },
        {
            "binary_version": "1.32.7-1ubuntu0.1",
            "binary_name": "libout123-0t64-dbgsym"
        },
        {
            "binary_version": "1.32.7-1ubuntu0.1",
            "binary_name": "libsyn123-0t64"
        },
        {
            "binary_version": "1.32.7-1ubuntu0.1",
            "binary_name": "libsyn123-0t64-dbgsym"
        },
        {
            "binary_version": "1.32.7-1ubuntu0.1",
            "binary_name": "mpg123"
        },
        {
            "binary_version": "1.32.7-1ubuntu0.1",
            "binary_name": "mpg123-dbgsym"
        }
    ]
}

Ubuntu:24.04:LTS / mpg123

Package

Name: mpg123
Purl: pkg:deb/ubuntu/mpg123?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.32.5-1ubuntu1.1

Affected versions

1.*

1.31.3-2

1.32.3-1

1.32.4-1

1.32.5-1

1.32.5-1build2

1.32.5-1ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.32.5-1ubuntu1.1",
            "binary_name": "libmpg123-0t64"
        },
        {
            "binary_version": "1.32.5-1ubuntu1.1",
            "binary_name": "libmpg123-0t64-dbgsym"
        },
        {
            "binary_version": "1.32.5-1ubuntu1.1",
            "binary_name": "libmpg123-dev"
        },
        {
            "binary_version": "1.32.5-1ubuntu1.1",
            "binary_name": "libout123-0t64"
        },
        {
            "binary_version": "1.32.5-1ubuntu1.1",
            "binary_name": "libout123-0t64-dbgsym"
        },
        {
            "binary_version": "1.32.5-1ubuntu1.1",
            "binary_name": "libsyn123-0t64"
        },
        {
            "binary_version": "1.32.5-1ubuntu1.1",
            "binary_name": "libsyn123-0t64-dbgsym"
        },
        {
            "binary_version": "1.32.5-1ubuntu1.1",
            "binary_name": "mpg123"
        },
        {
            "binary_version": "1.32.5-1ubuntu1.1",
            "binary_name": "mpg123-dbgsym"
        }
    ]
}