mpg123 -- buffer overflow in URL handling

Carlos Barros reports that mpg123 contains two buffer
overflows. These vulnerabilities can potentially lead to
execution of arbitrary code.
The first buffer overflow can occur when mpg123 parses a
URL with a user-name/password field that is more than 256
characters long. This problem can be triggered either
locally or remotely via a specially crafted play list. The
second potential buffer overflow may be triggered locally by
a specially crafted symlink to the mpg123 binary. This
problem is not as serious, since mpg123 is not installed
setuid by default.