Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-1301

Integer signedness error in the store_id3_text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via an ID3 tag with a negative encoding value. NOTE: some of these details are obtained from third party information.

Published

2009-04-16T15:12:57.483

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 10.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-189
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mpg123 mpg123 ≤ 1.7.1 Yes
Application mpg123 mpg123 0.59m Yes
Application mpg123 mpg123 0.59n Yes
Application mpg123 mpg123 0.59o Yes
Application mpg123 mpg123 0.59p Yes
Application mpg123 mpg123 0.59q Yes
Application mpg123 mpg123 0.59r Yes
Application mpg123 mpg123 0.59s Yes
Application mpg123 mpg123 0.62 Yes
Application mpg123 mpg123 1.6.3 Yes
Application mpg123 mpg123 1.6.4 Yes
Application mpg123 mpg123 1.7.0 Yes
Application mpg123 mpg123 pre0.59s Yes
Application mpg123 mpg123 pre0.59s_r11 Yes
References