USN-7092-1 fixed a vulnerability in mpg123. Bastien Roucariès discovered that the fix was incomplete on Ubuntu 20.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that mpg123 incorrectly handled certain mp3 files. If a user or automated system were tricked into opening a specially crafted mp3 file, a remote attacker could use this issue to cause mpg123 to crash, resulting in a denial of service, or possibly execute arbitrary code.
{ "availability": "No subscription required", "binaries": [ { "binary_version": "1.25.13-1ubuntu0.2", "binary_name": "libmpg123-0" }, { "binary_version": "1.25.13-1ubuntu0.2", "binary_name": "libmpg123-0-dbgsym" }, { "binary_version": "1.25.13-1ubuntu0.2", "binary_name": "libmpg123-dev" }, { "binary_version": "1.25.13-1ubuntu0.2", "binary_name": "libout123-0" }, { "binary_version": "1.25.13-1ubuntu0.2", "binary_name": "libout123-0-dbgsym" }, { "binary_version": "1.25.13-1ubuntu0.2", "binary_name": "mpg123" }, { "binary_version": "1.25.13-1ubuntu0.2", "binary_name": "mpg123-dbgsym" } ] }