mpg123 contains an overflow condition in the handling of MP2 or MP3 files. The issue is due to the 'do_layer()' function in layer2.c not validating user-supplied input. With a specially crafted MP2 or MP3 file, a context-dependent attacker can cause a buffer overflow, resulting in a denial of service or potentially execution of arbitrary code.

Multiple vendors have released a patch to address this vulnerability. Check the vendor advisory, changelog, or solution in the references section for details.

• Security Tracker: 1011170
• Secunia Advisory ID: 12478 12565 12628 12820
• CVE ID: 2004-0805 (see also: NVD)
• Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0189.html
• Vendor Specific Advisory URL: http://security.gentoo.org/glsa/glsa-200409-20.xml
• Other Advisory URL: http://www.alighieri.org/advisories/advisory-mpg123.txt
  http://www.debian.org/security/2004/dsa-564
  http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:100
• Vendor URL: http://www.mpg123.de/

• Davide Del Vecchio