Secunia

Horst Schirmeier has reported a vulnerability in Gentoo's mpg123 package, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a Gentoo specific patch, which fails to terminate strings properly. This can be exploited to cause a heap-based buffer overflow by enticing a user into connecting to a malicious server.

Successful exploitation may allow execution of arbitrary code.

Solution
Update to "media-sound/mpg123-0.59s-r11" or later.

Provided and/or discovered by
Horst Schirmeier

Changelog
Further details available in Customer Area

Original Advisory
http://www.gentoo.org/security/en/glsa/glsa-200607-01.xml

Deep Links
Links available in Customer Area