CVE-2006-3355: Buffer Overflow

Published Jul 6, 2006

Updated

Heap-based buffer overflow in httpdget.c in mpg123 before 0.59s-rll allows remote attackers to execute arbitrary code via a long URL, which is not properly terminated before being used with the strncpy function. NOTE: This appears to be the result of an incomplete patch for CVE-2004-0982.

Affected Software

1 affected component

mpg123 mpg123=pre0.59s_r11

Remediation

Patch Available

http://security.gentoo.org/glsa/glsa-200607-01.xml

Event History

Jul 6, 2006

CVE Published

08:05 PM

Jul 7, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3355?

CVE-2006-3355 has a severity rating of high due to its potential to allow remote code execution.

How do I fix CVE-2006-3355?

To fix CVE-2006-3355, users should update to the latest version of mpg123 that addresses this vulnerability.

What type of vulnerability is CVE-2006-3355?

CVE-2006-3355 is a heap-based buffer overflow vulnerability in the mpg123 audio player.

Who can be affected by CVE-2006-3355?

Any user running mpg123 versions prior to 0.59s-rll may be affected by CVE-2006-3355.

What causes CVE-2006-3355?

CVE-2006-3355 is caused by improper handling of long URLs in the httpdget.c file, leading to a buffer overflow.