A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
For the current stable distribution (woody) this problem has been fixed in version 0.2.10.2.
For the unstable distribution (sid) this problem has been fixed in version 0.2.10.3.
We recommend that you update your mpg321 package.
MD5 checksums of the listed files are available in the original advisory.