CVE-2016-1000247
mpg123 - security update
No scoreFix available
Jerold Hoong discovered a flaw in the id3 tag processing code of libmpg123. A specially crafted mp3 input file could be used to cause a buffer over-read, resulting in a denial of service (CVE-2016-1000247).
What each source reports
OSVMGASA-2016-0358 No score
Updated mpg123 packages fix security vulnerability
Jerold Hoong discovered a flaw in the id3 tag processing code of libmpg123. A specially crafted mp3 input file could be used to cause a buffer over-read, resulting in a denial of service (CVE-2016-1000247).
- Record
MGASA-2016-0358- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1000247 No score
mpg123 memory overread
- Record
UBUNTU-CVE-2016-1000247- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mpg123Debian:12 |
before 1.23.8-1 | 1.23.8-1 |
mpg123Debian:13 |
before 1.23.8-1 | 1.23.8-1 |
mpg123Debian:14 |
before 1.23.8-1 | 1.23.8-1 |
mpg123Debian:7 From an advisory covering 2 CVEs |
before 1.14.4-1+deb7u1, plus listed versions 1.14.4-1 |
1.14.4-1+deb7u1 |
mpg123Mageia:5 |
before 1.20.1-4.1.mga5 | 1.20.1-4.1.mga5 |
mpg123Ubuntu:14.04:LTS |
before 1.16.0-1ubuntu1.1, plus listed versions 1.15.3-1ubuntu11.16.0-1ubuntu1 |
1.16.0-1ubuntu1.1 |
mpg123Ubuntu:16.04:LTS |
before 1.22.4-1ubuntu0.1, plus listed versions 1.22.2-11.22.4-1 |
1.22.4-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1000247 is a vulnerability with no CVSS score yet in mpg123, published January 1, 0001. No source lists public exploit code. Fixed in mpg123 1.23.8-1.