Bug 1470101 (CVE-2017-10683, CVE-2017-11126, CVE-2017-12797, CVE-2017-9545)

Summary:	CVE-2017-10683 CVE-2017-11126 CVE-2017-9545 CVE-2017-12797 mpg123: Multiple vulnerabilities
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	negativo17, wtaymans
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mpg123 1.25.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:16:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1470103, 1470104
Bug Blocks:

Description Andrej Nemec 2017-07-12 12:04:34 UTC

The III_i_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the "block_type != 2" case, a similar issue to CVE-2017-9870.

References:

https://blogs.gentoo.org/ago/2017/07/03/mpg123-global-buffer-overflow-in-iii_i_stereo-layer3-c/

Upstream patch:

https://scm.orgis.org/view/mpg123/trunk/src/libmpg123/layer3.c?view=patch&r1=4275&r2=4274&pathrev=4275

Comment 1 Andrej Nemec 2017-07-12 12:04:56 UTC

Created mpg123 tracking bugs for this issue:

Affects: epel-7 [bug 1470103]
Affects: fedora-all [bug 1470104]

Comment 2 Andrej Nemec 2017-07-12 14:31:29 UTC

Adding one issue.

CVE-2017-10683

In mpg123 1.25.0, there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c. A crafted input will lead to a denial of service attack.

Product bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1465819

Comment 3 Andrej Nemec 2017-07-27 09:02:35 UTC

Adding one issue.

CVE-2017-9545

The next_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows attackers to cause a denial of service (buffer over-read) via a crafted mp3 file. 

References:

http://seclists.org/fulldisclosure/2017/Jul/65

Comment 4 Andrej Nemec 2017-09-04 08:05:49 UTC

CVE-2017-12797

Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers to cause a denial of service via a crafted file, which triggers a heap-based buffer overflow. 

https://sourceforge.net/p/mpg123/bugs/254/

Comment 5 Product Security DevOps Team 2019-06-08 03:16:20 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.