GCVE - cpe:2.3:a:mpg123:mpg123:0.59q:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mpg123:mpg123:0.59q:*:*:*:*:*:*:*

part: a version: 0.59q update: *

Vendor	Mpg123 (`8b1f944d-5fe2-5fd8-bc2b-11a288a174e1`)
Product	Mpg123 (`63f68f5a-65ed-5536-a466-877466d02cbe`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/treasurebox/mpg123`	purl2cpe	2026-06-01 10:13:00.288462
`pkg:deb/debian/mpg123`	purl2cpe	2026-06-01 10:13:00.288464
`pkg:deb/ubuntu/mpg123`	purl2cpe	2026-06-01 10:13:00.288466
`pkg:github/georgi/mpg123`	purl2cpe	2026-06-01 10:13:00.288467
`pkg:rpm/centos/mpg123`	purl2cpe	2026-06-01 10:13:00.288469
`pkg:rpm/fedora/mpg123`	purl2cpe	2026-06-01 10:13:00.288470
`pkg:rpm/opensuse/mpg123`	purl2cpe	2026-06-01 10:13:00.288472
`pkg:sourceforge/mpg123`	purl2cpe	2026-06-01 10:13:00.288473

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2009-1301`	vulnerable	2026-06-08 04:51:14.419034	Details available Integer signedness error in the store_id3_text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via an ID3 tag with a negative encoding value. NOTE: some of these details are obtained from third party information. Published: 2009-04-16T15:00:00.000Z Updated: 2024-08-07T05:04:49.529Z Open on db.gcve.eu Reference links http://bugs.gentoo.org/show_bug.cgi?id=265342 http://sourceforge.net/project/shownotes.php?release_id=673696 http://www.mandriva.com/security/advisories?name=MDVSA-2009:093 http://secunia.com/advisories/34748 http://secunia.com/advisories/34587	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-0578`	vulnerable	2026-06-08 04:49:32.834712	Details available The http_open function in httpget.c in mpg123 before 0.64 allows remote attackers to cause a denial of service (infinite loop) by closing the HTTP connection early. Published: 2007-01-30T17:00:00.000Z Updated: 2024-08-07T12:26:53.255Z Open on db.gcve.eu Reference links http://www.mandriva.com/security/advisories?name=MDKSA-2007:032 http://www.securityfocus.com/bid/22274 http://osvdb.org/40128 http://www.vupen.com/english/advisories/2007/0366 http://www.mpg123.de/cgi-bin/news.cgi	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2004-1284`	vulnerable	2026-06-08 04:47:53.488879	Details available Buffer overflow in the find_next_file function in playlist.c for mpg123 0.59r allows remote attackers to execute arbitrary code via a crafted MP3 playlist. Published: 2004-12-22T05:00:00.000Z Updated: 2024-08-08T00:46:12.360Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/18626 http://tigger.uic.edu/~jlongs2/holes/mpg123.txt http://www.novell.com/linux/security/advisories/2005_01_sr.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2004-0991`	vulnerable	2026-06-08 04:47:52.222325	Details available Buffer overflow in mpg123 before 0.59s-r9 allows remote attackers to execute arbitrary code via frame headers in MP2 or MP3 files. Published: 2005-01-19T05:00:00.000Z Updated: 2024-08-08T00:39:00.610Z Open on db.gcve.eu Reference links http://secunia.com/advisories/13899 http://security.gentoo.org/glsa/glsa-200501-14.xml http://www.mandriva.com/security/advisories?name=MDKSA-2005:009 http://www.securityfocus.com/bid/12218 http://secunia.com/advisories/13779	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Mpg123

Notes

PURL mappings

Vulnerability references

Contribute