Debian-LTS has issued an advisory on October 15: http://lwn.net/Alerts/703760/ The issue is fixed upstream in 1.23.8. Freeze push requested for Cauldron. Upstream announcement is here: http://www.mpg123.de/cgi-bin/news.cgi Patch checked into Mageia 5 SVN.
Patched package uploaded for Mageia 5. Advisory: ======================== Updated mpg123 packages fix security vulnerability: Jerold Hoong discovered a flaw in the id3 tag processing code of libmpg123. A specially crafted mp3 input file could be used to cause a buffer over-read, resulting in a denial of service (CVE-2016-1000247). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000247 http://www.mpg123.de/cgi-bin/news.cgi http://lwn.net/Alerts/703760/ ======================== Updated packages in core/updates_testing: ======================== mpg123-1.20.1-4.1.mga5 mpg123-pulse-1.20.1-4.1.mga5 mpg123-jack-1.20.1-4.1.mga5 mpg123-portaudio-1.20.1-4.1.mga5 mpg123-sdl-1.20.1-4.1.mga5 mpg123-openal-1.20.1-4.1.mga5 libmpg123_0-1.20.1-4.1.mga5 libmpg123-devel-1.20.1-4.1.mga5 from mpg123-1.20.1-4.1.mga5.src.rpm
Assignee: bugsquad => qa-bugs
MGA5-32 on Acer D620 Xfce No installation issues Played mp3 file with mpg123 OK
CC: (none) => herman.viaeneWhiteboard: (none) => MGA5-32-OK
Advisory uploaded.
CC: (none) => lewyssmithWhiteboard: MGA5-32-OK => MGA5-32-OK advisory
Keywords: (none) => validated_updateCC: (none) => davidwhodgins, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0358.html
Status: NEW => RESOLVEDResolution: (none) => FIXED