Detections
Analytics

Alpine: mpg123: security update to 1.25.4-r0

medium Tenable Self-Hosted Container Security Plugin ID 405634

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - The next_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows remote attackers to cause a denial
 of service (buffer over-read) via a crafted mp3 file. (CVE-2017-9545)

 - The III_i_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause
 a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled
 in the code for the "block_type != 2" case, a similar issue to CVE-2017-9870. (CVE-2017-11126)

See Also

https://security.alpinelinux.org/vuln/CVE-2017-11126

https://security.alpinelinux.org/vuln/CVE-2017-9545

Plugin Details

Severity: Medium

ID: 405634

Version: Revision 1.24

Type: Local

Published: 10/31/2023

Updated: 3/13/2025

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2017-9545

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 7/10/2017

Reference Information

CVE: CVE-2017-11126, CVE-2017-9545