CVE catalog

CVE-2019-18359

mp3gain: CVE-2019-18359

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.40% · Oct 25, 2026

A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmp3gainsid1.6.2-3fixed
Debianmp3gainforky1.6.2-3fixed
Debianmp3gaintrixie1.6.2-2fixed
Debianmp3gainbookworm1.6.2-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmp3gainsourcesid1.6.2-2not yet assignedNot reported[973932]
Debianmp3gainsourceforky1.6.2-2not yet assignedNot reported[973932]
Debianmp3gainsourcetrixie1.6.2-2not yet assignedNot reported[973932]
Debianmp3gainsourcebookworm1.6.2-2not yet assignedNot reported[973932]

[Debian bug #973932]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [mp3gain]Fixed
    Details (2)

    • 1.6.2-2 · amd64 · bookworm

      Fixed · Fixed: 1.6.2-2

      dsa · mp3gain · debian · bookworm; dsa · mp3gain · debian · 12

    • 1.6.2-2 · arm64 · bookworm

      Fixed · Fixed: 1.6.2-2

      dsa · mp3gain · debian · bookworm; dsa · mp3gain · debian · 12

[Debian 13 (Trixie)]

  • [mp3gain]Fixed

    Source package: [mp3gain]

    Details (2)

    • 1.6.2-2+b1 · amd64 · trixie

      Fixed · Fixed: 1.6.2-2

      dsa · mp3gain · debian · 13

    • 1.6.2-2+b2 · arm64 · trixie

      Fixed · Fixed: 1.6.2-2

      dsa · mp3gain · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]