CVE-2019-18359
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The...
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service.
- Record
CVE-2019-18359- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service.
- Record
CVE-2019-18359- Updated
- 2026-11-02
EUVDEUVD-2019-8144 No score
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service.
- Record
EUVD-2019-8144- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-74ch-gqq9-g83c
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The...
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service.
- Record
GHSA-74ch-gqq9-g83c- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service.
- Record
CVE-2019-18359- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-18359
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service.
- Record
DEBIAN-CVE-2019-18359- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2020-0179 No score
Updated mp3gain packages fix security vulnerability
The updated package fixes a security vulnerability:
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service. (CVE-2019-18359)
- Record
MGASA-2020-0179- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0522-1 No score
Security update for mp3gain
This update for mp3gain fixes the following issues:
Update to version 1.6.2.
- CVE-2019-18359: Fixed a buffer over-read was discovered in ReadMP3APETag (boo#1154971)
- Record
openSUSE-SU-2020:0522-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0539-1 No score
Security update for mp3gain
This update for mp3gain fixes the following issues:
Update to version 1.6.2.
- CVE-2019-18359: Fixed a buffer over-read was discovered in ReadMP3APETag (boo#1154971)
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0539-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11060-1 No score
mp3gain-1.6.2-2.9 on GA media
These are all security issues fixed in the mp3gain-1.6.2-2.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11060-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mp3gainDebian:12 |
before 1.6.2-2 | 1.6.2-2 |
mp3gainDebian:13 |
before 1.6.2-2 | 1.6.2-2 |
mp3gainDebian:14 |
before 1.6.2-2 | 1.6.2-2 |
mp3gainMageia:7 |
before 1.6.2-2.1.mga7 | 1.6.2-2.1.mga7 |
mp3gainopenSUSE:Leap 15.1 From an advisory covering 2 CVEs |
before 1.6.2-lp151.3.3.1 | 1.6.2-lp151.3.3.1 |
mp3gainSUSE:Package Hub 15 SP1 From an advisory covering 2 CVEs |
before 1.6.2-bp151.4.3.1 | 1.6.2-bp151.4.3.1 |
mp3gainopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.6.2-2.9 | 1.6.2-2.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-18359 is a medium vulnerability (CVSS 5.5) in Glensawyer Mp3gain, published October 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in mp3gain 1.6.2-2.
References
sourceforge.net/p/mp3gain/bugs/46
lists.opensuse.org/opensuse-security-announce/2020-04/msg00025.html
nvd.nist.gov/vuln/detail/CVE-2019-18359
github.com/advisories/GHSA-74ch-gqq9-g83c
security-tracker.debian.org/tracker/CVE-2019-18359
Show 8 moreShow less
advisories.mageia.org/MGASA-2020-0179.html
bugs.mageia.org/show_bug.cgi?id=26504
bugzilla.suse.com/1154971
suse.com/security/cve/CVE-2017-12911