CVE-2017-12797 (https://nvd.nist.gov/vuln/detail/CVE-2017-12797): Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers to cause a denial of service via a crafted file, which triggers a heap-based buffer overflow. References: https://sourceforge.net/p/mpg123/bugs/254/ https://sourceforge.net/p/mpg123/mailman/message/35987663/ @Maintainer(s): Please note that only x86 is vulnerable and state when you are ready for stabilization.
x86 stable
Stable on amd64
ia64 stable
ppc/ppc64 stable
hppa stable
Stable on alpha.
arm stable, all arches done.
Thank you arches. @ Maintainer(s): Please clean the vulnerable versions from tree. @ Security: Please vote on glsa.
GLSA Vote: No
Tree is clean.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=557a30063403e2ace8592cb4fe29a4af6f37ceca commit 557a30063403e2ace8592cb4fe29a4af6f37ceca Author: Rolf Eike Beer <eike@sf-mail.de> AuthorDate: 2018-05-08 18:18:17 +0000 Commit: Sergei Trofimovich <slyfox@gentoo.org> CommitDate: 2018-05-08 18:42:39 +0000 media-sound/mpg123: stable 1.25.6 for sparc Bug: https://bugs.gentoo.org/631604 Package-Manager: Portage-2.3.24, Repoman-2.3.6 RepoMan-Options: --include-arches="sparc" media-sound/mpg123/mpg123-1.25.6.ebuild | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
