Summary
The remote host is missing an update to mpg123
announced via advisory DSA 564-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20564-1
Insight
Davide Del Vecchio discovered a vulnerability mpg123, a popular (but non-free) MPEG layer 1/2/3 audio player. A malicious MPEG layer 2/3 file could cause the header checks in mpg123 to fail, which could in turn allow arbitrary code to be executed with the privileges of the user running mpg123.
For the stable distribution (woody) this problem has been fixed in version 0.59r-13woody3.
For the unstable distribution (sid) this problem has been fixed in version 0.59r-16.
We recommend that you upgrade your mpg123 package.
Severity
Classification
-
CVE CVE-2004-0805 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities