CVE-2017-12839 - mpg123: heap-based buffer over-read in function getbits insrc/libmpg123/getbits.h

Back Back to CVE browser

HIGH

mpg123: heap-based buffer over-read in function getbits insrc/libmpg123/getbits.h

Published May 9, 2019

8.3

HIGH

CVSS 3.0

EPSS 2.90%

Description

A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a possible denial-of-service (out-of-bounds read) or possibly have unspecified other impact via a crafted mp3 file.

Affected products

Red Hat Enterprise Linux 7

mpg123

Not affected
Red Hat Enterprise Linux 8

mpg123

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	mpg123	Not affected	n/a
Red Hat Enterprise Linux 8	mpg123	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (7)

https://access.redhat.com/security/cve/CVE-2017-12839
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1708559
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-12839
https://sourceforge.net/p/mpg123/bugs/255/
x_refsource_MISCExploitThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-12839
https://www.mpg123.de/
x_refsource_MISCProductVendor Advisory
https://www.mpg123.de/cgi-bin/scm/mpg123/trunk/src/libmpg123/getbits.h?r1=2024&r2=4323&sortby=date
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2017-12839		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1708559		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-12839
https://sourceforge.net/p/mpg123/bugs/255/		x_refsource_MISCExploitThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-12839
https://www.mpg123.de/		x_refsource_MISCProductVendor Advisory
https://www.mpg123.de/cgi-bin/scm/mpg123/trunk/src/libmpg123/getbits.h?r1=2024&r2=4323&sortby=date		x_refsource_MISCPatchVendor Advisory