6.7

CVE-2024-10573

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Collection URLhttps://sourceforge.net/projects/mpg123/
≫
Paket mpg123
Default Statusunaffected
Version < 1.32.8
Version 0
Status affected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 8
Default Statusaffected
Version < *
Version 0:1.32.9-1.el8_10
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9
Default Statusaffected
Version < *
Version 0:1.32.9-1.el9_5
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 7
Default Statusunknown
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.09% 0.263
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
secalert@redhat.com 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.