{"id":"CVE-2024-10573","aliases":["ALPINE-CVE-2024-10573","ALSA-2024:11193","ALSA-2024:11242","CLSA-2026-1779694248","DEBIAN-CVE-2024-10573","DLA-3967-1","DSA-5811-1","EUVD-2024-33569","GHSA-7m7j-pgpw-9g75","MGASA-2024-0358","RHSA-2024:11193","RHSA-2024:11242","RLSA-2024:11193","RLSA-2024:11242","UBUNTU-CVE-2024-10573","USN-7092-1","USN-7092-2","openSUSE-SU-2024:14454-1"],"status":"published","title":"Mpg123: buffer overflow when writing decoded pcm samples","description":"An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00346,"percentile":0.28552,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2024-10-30T00:00:00Z","modified":"2026-11-05T11:40:40Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"mpg123","fixed_in":["1.32.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"mpg123","fixed_in":["1.32.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"mpg123","fixed_in":["1.32.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"mpg123","fixed_in":["1.32.8-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"mpg123","fixed_in":["1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"mpg123-devel","fixed_in":["1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"mpg123-libs","fixed_in":["1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"mpg123-plugins-pulseaudio","fixed_in":["1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"mpg123","fixed_in":["1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"mpg123-devel","fixed_in":["1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"mpg123-libs","fixed_in":["1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"mpg123-plugins-pulseaudio","fixed_in":["1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"mpg123","fixed_in":["1.26.2-5.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"mpg123-devel","fixed_in":["1.26.2-5.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"mpg123-libs","fixed_in":["1.26.2-5.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"mpg123-plugins-pulseaudio","fixed_in":["1.26.2-5.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mpg123","fixed_in":["1.31.2-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mpg123","fixed_in":["1.32.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mpg123","fixed_in":["1.32.8-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"mpg123","fixed_in":["1.26.4-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"mpg123","fixed_in":["1.31.3-1.1.mga9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-debuginfo","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-debugsource","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-libs","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-libs-debuginfo","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-plugins-pulseaudio","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-plugins-pulseaudio-debuginfo","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mpg123-debuginfo","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mpg123-debugsource","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mpg123-devel","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mpg123-libs-debuginfo","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mpg123-plugins-pulseaudio-debuginfo","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-debuginfo","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-debugsource","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-libs","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-libs-debuginfo","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-plugins-pulseaudio","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-plugins-pulseaudio-debuginfo","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mpg123-debuginfo","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mpg123-debugsource","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mpg123-devel","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mpg123-libs-debuginfo","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mpg123-plugins-pulseaudio-debuginfo","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"mpg123","fixed_in":["0:1.32.9-1.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"mpg123","fixed_in":["0:1.32.9-1.el9_5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"mpg123","fixed_in":["1.25.13-1ubuntu0.2","1.25.13-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"mpg123","fixed_in":["1.29.3-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"mpg123","fixed_in":["1.32.5-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mpg123","fixed_in":["1.32.9-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.8-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mpg123-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mpg123-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mpg123-plugins-pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mpg123-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mpg123-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mpg123-plugins-pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-5.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mpg123-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-5.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mpg123-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-5.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mpg123-plugins-pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-5.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.2-1+deb12u1"}]}],"versions":["1.31.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.8-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-1+deb11u1"}]}],"versions":["1.26.4-1"]},{"source":"osv","ecosystem":"Debian:12","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.2-1+deb12u1"}]}],"versions":["1.31.2-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.3-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-plugins-pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mpg123-plugins-pulseaudio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mpg123-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mpg123-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mpg123-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mpg123-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mpg123-plugins-pulseaudio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-plugins-pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mpg123-plugins-pulseaudio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mpg123-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mpg123-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mpg123-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mpg123-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mpg123-plugins-pulseaudio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.9-1.el9_5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.3-1ubuntu1","1.16.0-1ubuntu1","1.16.0-1ubuntu1.1","1.16.0-1ubuntu1.1+esm1","1.16.0-1ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-1","1.22.4-1","1.22.4-1ubuntu0.1","1.22.4-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.6-1","1.25.7-1","1.25.8-1","1.25.10-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-1ubuntu0.2"}]}],"versions":["1.25.12-1build1","1.25.13-1","1.25.13-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.3-1ubuntu0.1"}]}],"versions":["1.28.2-2","1.29.2-1","1.29.3-1","1.29.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.5-1ubuntu1.1"}]}],"versions":["1.31.3-2","1.32.3-1","1.32.4-1","1.32.5-1","1.32.5-1build2","1.32.5-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-1ubuntu0.1"}]}],"versions":["1.25.12-1build1","1.25.13-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.3-1ubuntu0.1"}]}],"versions":["1.28.2-2","1.29.2-1","1.29.3-1","1.29.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.5-1ubuntu1.1"}]}],"versions":["1.31.3-2","1.32.3-1","1.32.4-1","1.32.5-1","1.32.5-1build2","1.32.5-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-1ubuntu0.2"}]}],"versions":["1.25.12-1build1","1.25.13-1","1.25.13-1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mpg123","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.9-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:11193","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11242","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-10573","tags":["vdb-entry","x_refsource_REDHAT","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2322980","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://mpg123.org/cgi-bin/news.cgi#2024-10-26","tags":["web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2024/10/30/3","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/10/31/4","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/11/01/1","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00025.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10573","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7m7j-pgpw-9g75"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-10573","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2322980","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-11193.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-11242.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779694248.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-10573","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0358.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33711","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/10/30/2","tags":["web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/10/30/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/10/31/4","tags":["web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/11/01/2","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11193.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-10573","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11242.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:11193","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:11242","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-10573","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/10/31/3","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7092-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7092-2","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2089680","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10573","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-10573","title":"Mpg123: buffer overflow when writing decoded pcm samples","description":"An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.","status":"published","published":"2024-10-31T18:31:55.94Z","modified":"2026-11-05T11:40:40.236Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-05T13:18:22.408512Z"}],"euvd":[{"id":"EUVD-2024-33569","description":"An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.","status":"published","published":"2024-10-31T18:31:55Z","modified":"2026-11-05T11:40:40Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-05T13:14:14.11293Z"}],"ghsa":[{"id":"GHSA-7m7j-pgpw-9g75","title":"An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM,...","description":"An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.","status":"published","published":"2024-10-31T21:31:45Z","modified":"2024-12-18T09:31:35Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:59:13.557601Z"}],"nvd":[{"id":"CVE-2024-10573","description":"An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.","status":"published","published":"2024-10-31T19:15:12.54Z","modified":"2026-11-05T12:17:43.94Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-05T16:36:41.817182Z"}],"osv":[{"id":"ALPINE-CVE-2024-10573","description":"An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.","status":"published","published":"2024-10-31T19:15:12.54Z","modified":"2026-11-02T11:17:50.051074817Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"DEBIAN-CVE-2024-10573","description":"An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.","status":"published","published":"2024-10-31T19:15:12.54Z","modified":"2026-11-02T12:00:23.921098534Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"RHSA-2024:11193","title":"Red Hat Security Advisory: mpg123 security update","status":"published","published":"2024-12-18T10:06:04Z","modified":"2026-07-12T10:02:28Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11242","title":"Red Hat Security Advisory: mpg123:1.32.9 security update","status":"published","published":"2024-12-18T10:06:08Z","modified":"2026-07-12T10:02:29Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RLSA-2024:11193","title":"Moderate: mpg123 security update","description":"The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries.\n\nSecurity Fix(es):\n\n* mpg123: Buffer overflow when writing decoded PCM samples (CVE-2024-10573)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T20:08:45.916768Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"RLSA-2024:11242","title":"Moderate: mpg123:1.32.9 security update","description":"The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries.\n\nSecurity Fix(es):\n\n* mpg123: Buffer overflow when writing decoded PCM samples (CVE-2024-10573)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-03-17T20:16:45.510776Z","modified":"2025-10-09T05:47:29.009928Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2024-10573","description":"An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.","status":"published","published":"2024-10-30T00:00:00Z","modified":"2026-04-22T14:37:28.470422Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"ALSA-2024:11193","title":"Moderate: mpg123 security update","description":"The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries.  \n\nSecurity Fix(es):  \n\n  * mpg123: Buffer overflow when writing decoded PCM samples (CVE-2024-10573)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-17T00:00:00Z","modified":"2026-10-29T11:02:26.330626073Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:11242","title":"Moderate: mpg123:1.32.9 security update","description":"The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries.  \n\nSecurity Fix(es):  \n\n  * mpg123: Buffer overflow when writing decoded PCM samples (CVE-2024-10573)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-17T00:00:00Z","modified":"2026-10-29T11:32:01.38807433Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2026-1779694248","title":"mpg123: Fix of CVE-2024-10573","description":"- CVE-2024-10573: Out-of-bounds write during PCM decoding of crafted streams\n  could lead to heap corruption and potential arbitrary code execution; decode\n  the MPEG header into a temporary copy that is only applied to the live\n  handle after the frame body is validated (upstream svn-r5442, main fix), and\n  gate decode_the_frame() behind a FRAME_DECODER_LIVE state bit so it cannot\n  run with stale state when decode_update() failed (upstream svn-r4991 plus\n  the bug-324 precedence fix from 1.29.2, follow-up safeguard).","status":"published","published":"2026-05-25T07:30:53Z","modified":"2026-06-01T00:32:35.046617283Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CVE-2024-10573","description":"An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.","status":"published","published":"2024-10-31T19:15:12Z","modified":"2026-04-16T04:39:08.561485602Z","updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"DLA-3967-1","title":"mpg123 - security update","status":"published","published":"2024-11-26T00:00:00Z","modified":"2026-03-09T01:20:03.456358Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5811-1","title":"mpg123 - security update","status":"published","published":"2024-11-11T00:00:00Z","modified":"2026-03-09T02:10:08.88381Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0358","title":"Updated mpg123 packages fix security vulnerability","description":"An out-of-bounds write flaw was found in mpg123 when handling crafted\nstreams. When decoding PCM, the libmpg123 may write past the end of a\nheap-located buffer. Consequently, heap corruption may happen, and\narbitrary code execution may not be dismissed. The complexity required to\nexploit this flaw is considered high as the payload must be validated by\nthe MPEG decoder and the PCM synth before execution. Additionally, to\nsuccessfully execute the attack, the user must scan through the stream,\nmaking web live stream content (such as web radios) a very unlikely\nattack vector. (CVE-2024-10573)\n","status":"published","published":"2024-11-12T19:53:59Z","modified":"2026-04-16T04:44:02.615354675Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14454-1","title":"libmpg123-0-1.32.9-1.1 on GA media","description":"These are all security issues fixed in the libmpg123-0-1.32.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-03T00:00:00Z","modified":"2025-05-07T18:15:39.67784Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"USN-7092-1","title":"mpg123 vulnerability","description":"It was discovered that mpg123 incorrectly handled certain mp3 files. If a\nuser or automated system were tricked into opening a specially crafted mp3\nfile, a remote attacker could use this issue to cause mpg123 to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2024-11-05T12:59:36Z","modified":"2026-04-27T17:33:50.471437Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7092-2","title":"mpg123 vulnerability","description":"USN-7092-1 fixed a vulnerability in mpg123. Bastien Roucariès discovered\nthat the fix was incomplete on Ubuntu 20.04 LTS. This update fixes the\nproblem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that mpg123 incorrectly handled certain mp3 files. If a\n user or automated system were tricked into opening a specially crafted mp3\n file, a remote attacker could use this issue to cause mpg123 to crash,\n resulting in a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2024-11-27T12:46:53Z","modified":"2026-04-27T17:34:42.042678Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}