CVE:CVE-2009-1301
CNNVD:CNNVD-200904-344
mpg123是软件开发者Michael Hipp所研发的一款使用于Linux和Unix操作系统下的MPEG音频播放器和解码库。
mpg123的libmpg123/id3.c文件的store_id3_text()函数中存在符号错误。如果用户受骗打开了设置有特制ID3标签的媒体文件的话，就可以出发越界内存访问，导致执行任意代码。
solution:Upgrade mpg123 mpg123 to a higher version than 1.7.1,0.59m,0.59n,0.59o,0.59p,0.59q,0.59r,0.59s,0.62,1.6.3,1.6.4,1.7.0,pre0.59s,pre0.59s_r11,and avoid the version (,1.7.1],0.59m,0.59n,0.59o,0.59p,0.59q,0.59r,0.59s,0.62,1.6.3,1.6.4,1.7.0,pre0.59s,pre0.59s_r11