Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-18201: A double-free flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files. 1549707: CVE-2017-18201 libcdio: Double free in get_cdtext_generic() in lib/driver/_cdio_generic.c CVE-2017-18199: A NULL pointer dereference flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files. 1549701: CVE-2017-18199 libcdio: NULL pointer dereference in realloc_symlink in rock.c CVE-2017-18198: A heap corruption bug was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files, thus resulting in local DoS. 1549644: CVE-2017-18198 libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libcdio | 0:0.92-3.amzn2 |
| Amazon Linux · 2 | libcdio-debuginfo | 0:0.92-3.amzn2 |
| Amazon Linux · 2 | libcdio-devel | 0:0.92-3.amzn2 |
Vulnerabilities 3
-
Unscored —
print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (h…
-
Unscored —
realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointe…
-
Unscored —
An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio…