Bug#866860: mpg123: CVE-2017-10683

[Salvatore Bonaccorso]

Source: mpg123
Version: 1.25.0-1
Severity: important
Tags: upstream security

Hi,

the following vulnerability was published for mpg123.

CVE-2017-10683[0]:
| In mpg123 1.25.0, there is a heap-based buffer over-read in the
| convert_latin1 function in libmpg123/id3.c. A crafted input will lead
| to a remote denial of service attack.

This was reported at [1], but Hanno Boeck recently reported [2] as
well.

Looking at both cases i think those should be the same issues, and
upstream has a patch for the issue.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-10683
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10683
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1465819
[2] https://sourceforge.net/p/mpg123/bugs/252/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore