An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libcdio packages installed that are affected by multiple vulnerabilities:

  - A heap corruption bug was found in the way libcdio     handled processing of ISO files. An attacker could     potentially use this flaw to crash applications using     libcdio by tricking them into processing crafted ISO     files, thus resulting in local DoS. (CVE-2017-18198)

  - A NULL pointer dereference flaw was found in the way     libcdio handled processing of ISO files. An attacker     could potentially use this flaw to crash applications     using libcdio by tricking them into processing crafted     ISO files. (CVE-2017-18199)

  - A double-free flaw was found in the way libcdio handled     processing of ISO files. An attacker could potentially     use this flaw to crash applications using libcdio by     tricking them into processing crafted ISO files.
    (CVE-2017-18201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libcdio fixes the following issues :

The following security vulnerabilities were addressed :

  - CVE-2017-18199: Fixed a NULL pointer dereference in     realloc_symlink in rock.c (bsc#1082821)

  - CVE-2017-18201: Fixed a double free vulnerability in     get_cdtext_generic() in _cdio_generic.c (bsc#1082877)

  - Fixed several memory leaks (bsc#1082821)

This update was imported from the SUSE:SLE-15:Update update project.

A heap corruption bug was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files, thus resulting in local DoS.(CVE-2017-18198)

A double-free flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.(CVE-2017-18201)

A NULL pointer dereference flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.(CVE-2017-18199)

This update for libcdio fixes the following issues: The following security vulnerabilities were addressed :

  - CVE-2017-18199: Fixed a NULL pointer dereference in     realloc_symlink in rock.c (bsc#1082821)

  - CVE-2017-18201: Fixed a double free vulnerability in     get_cdtext_generic() in _cdio_generic.c (bsc#1082877)

  - Fixed several memory leaks (bsc#1082821)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libcdio package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libcdio: Heap-based buffer over-read in     print_iso9660_recurse function in iso-info.c     (CVE-2017-18198)

  - libcdio: NULL pointer dereference in realloc_symlink in     rock.c (CVE-2017-18199)

  - libcdio: Double free in get_cdtext_generic() in     lib/driver/_cdio_generic.c (CVE-2017-18201)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - libcdio: Heap-based buffer over-read in     print_iso9660_recurse function in iso-info.c     (CVE-2017-18198)

  - libcdio: NULL pointer dereference in realloc_symlink in     rock.c (CVE-2017-18199)

  - libcdio: Double free in get_cdtext_generic() in     lib/driver/_cdio_generic.c (CVE-2017-18201)

An update for libcdio is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The libcdio library provides an interface for CD-ROM access. It can be used by applications that need OS-independent and device-independent access to CD-ROM devices.

Security Fix(es) :

* libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c (CVE-2017-18198)

* libcdio: NULL pointer dereference in realloc_symlink in rock.c (CVE-2017-18199)

* libcdio: Double free in get_cdtext_generic() in lib/driver/_cdio_generic.c (CVE-2017-18201)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

From Red Hat Security Advisory 2018:3246 :

An update for libcdio is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The libcdio library provides an interface for CD-ROM access. It can be used by applications that need OS-independent and device-independent access to CD-ROM devices.

Security Fix(es) :

* libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c (CVE-2017-18198)

* libcdio: NULL pointer dereference in realloc_symlink in rock.c (CVE-2017-18199)

* libcdio: Double free in get_cdtext_generic() in lib/driver/_cdio_generic.c (CVE-2017-18201)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3246 advisory.

  - libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c (CVE-2017-18198)

  - libcdio: NULL pointer dereference in realloc_symlink in rock.c (CVE-2017-18199)

  - libcdio: Double free in get_cdtext_generic() in lib/driver/_cdio_generic.c (CVE-2017-18201)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libcdio package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - This library provides an interface for CD-ROM access.
    It can be used by applications that need OS- and     device-independent access to CD-ROM devices.

  - Security fix(es):

  - A double-free flaw was found in the way libcdio handled     processing of ISO files. An attacker could potentially     use this flaw to crash applications using libcdio by     tricking them into processing crafted ISO     files.(CVE-2017-18201)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Added patch to fix: CVE-2017-18198 (#1549644) Added patch to fix:
CVE-2017-18199 (#1549701) Added patches to fix: CVE-2017-18201 (#1549707)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libcdio fixes the following issues :

  - CVE-2017-18201: Fixed a double free vulnerability     (bsc#1082877).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
127220	NewStart CGSL CORE 5.04 / MAIN 5.04 : libcdio Multiple Vulnerabilities (NS-SA-2019-0043)	Nessus	NewStart CGSL Local Security Checks	critical
123262	openSUSE Security Update : libcdio (openSUSE-2019-599)	Nessus	SuSE Local Security Checks	critical
121364	Amazon Linux 2 : libcdio (ALAS-2019-1151)	Nessus	Amazon Linux Local Security Checks	critical
120073	SUSE SLED15 / SLES15 Security Update : libcdio (SUSE-SU-2018:2236-1)	Nessus	SuSE Local Security Checks	critical
119518	EulerOS 2.0 SP3 : libcdio (EulerOS-SA-2018-1390)	Nessus	Huawei Local Security Checks	critical
119189	Scientific Linux Security Update : libcdio on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	critical
119000	CentOS 7 : libcdio (CESA-2018:3246)	Nessus	CentOS Local Security Checks	critical
118780	Oracle Linux 7 : libcdio (ELSA-2018-3246)	Nessus	Oracle Linux Local Security Checks	critical
118537	RHEL 7 : libcdio (RHSA-2018:3246)	Nessus	Red Hat Local Security Checks	critical
111638	openSUSE Security Update : libcdio (openSUSE-2018-857)	Nessus	SuSE Local Security Checks	critical
109480	EulerOS 2.0 SP2 : libcdio (EulerOS-SA-2018-1082)	Nessus	Huawei Local Security Checks	critical
109479	EulerOS 2.0 SP1 : libcdio (EulerOS-SA-2018-1081)	Nessus	Huawei Local Security Checks	critical
108494	Fedora 26 : libcdio (2018-199e6065ee)	Nessus	Fedora Local Security Checks	critical
108367	SUSE SLED12 / SLES12 Security Update : libcdio (SUSE-SU-2018:0673-1)	Nessus	SuSE Local Security Checks	critical
107162	Fedora 27 : libcdio (2018-30a8492364)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2017-18201

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical