libming is a Flash (SWF) output library. It can be used from PHP, Perl, Ruby, Python, C, C++, Java, and probably more on the way..
A fuzzing revealed a left shift in listmp3. The bug does not reside in any shared object but if you have a web application that calls directly the listmp3 binary to parse untrusted mp3, then you are affected.
The complete UBSan output:
# listmp3 $FILE listmp3.c:94:23: runtime error: left shift of negative value -1 listmp3.c:95:23: runtime error: left shift of negative value -1
This bug was discovered by Agostino Sarubbo of Gentoo.
2016-08-13: bug discovered
2016-10-20: bug reported to upstream
2016-11-09: blog post about the issue
2016-11-10: CVE assigned
2017-01-30: upstream released a patch
2017-04-07: upstream released 0.4.8
This bug was found with American Fuzzy Lop.