Unscored severity · published Feb 9, 2005
CVE-2004-0982
Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users to execute arbitrary code via an mp3…
–
CVSS
6.5%
EPSS
No
On KEV
Description
Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users to execute arbitrary code via an mp3 file that contains a long string before the @ (at sign) in a URL.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
Mpg123 · Mpg123
0.59r; pre0.59s · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0982
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0982
marc.info
http://marc.info/?l=bugtraq&m=109834486312407&w=2
secunia.com
http://secunia.com/advisories/12908
securitytracker.com
http://securitytracker.com/id?1011832
www.barrossecurity.com
http://www.barrossecurity.com/advisories/mpg123_getauthfromurl_bof_advisory.txt
Patch
http://www.debian.org/security/2004/dsa-578
www.gentoo.org
http://www.gentoo.org/security/en/glsa/glsa-200410-27.xml
More from Mpg123
8.3
CVE-2017-12839
A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a possible denial-of-service…
7.5
CVE-2014-9497
Buffer overflow in mpg123 before 1.18.0
7.5
CVE-2017-10683
In mpg123 1.25.0, there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c
5.5
CVE-2017-12797
Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers to cause a denial of service via a…
5.5
CVE-2017-9545
The next_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows remote attackers to cause a denial of service (buffer over-read) via a crafted mp3 file