CVE-2017-18201
libcdio: Double free in get_cdtext_generic() in lib/driver/_cdio_generic.c
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (low), Amazon (low), Oracle (low), Ubuntu (low).
Description
An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 2 | libcdio, libcdio-debuginfo, libcdio-devel | 0.92-3.amzn2 |
| debian 11 | libcdio | 2.0.0-2 |
| debian 12 | libcdio | 2.0.0-2 |
| debian 13 | libcdio | 2.0.0-2 |
| debian 14 | libcdio | 2.0.0-2 |
| echo | libcdio | 2.0.0-2 |
| Oracle Linux 7 | libcdio, libcdio-devel | 0.92-3.el7 |
| ubuntu 18.04-ESM | libcdio | 1.0.0-2ubuntu2 |
Show all 11 entries from 8 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 2 | libcdio | 0.92-3.amzn2 |
| amazon linux 2 | libcdio-debuginfo | 0.92-3.amzn2 |
| amazon linux 2 | libcdio-devel | 0.92-3.amzn2 |
| debian 11 | libcdio | 2.0.0-2 |
| debian 12 | libcdio | 2.0.0-2 |
| debian 13 | libcdio | 2.0.0-2 |
| debian 14 | libcdio | 2.0.0-2 |
| echo | libcdio | 2.0.0-2 |
| Oracle Linux 7 | libcdio | 0.92-3.el7 |
| Oracle Linux 7 | libcdio-devel | 0.92-3.el7 |
| ubuntu 18.04-ESM | libcdio | 1.0.0-2ubuntu2 |
References
- http://www.securityfocus.com/bid/103190
- https://access.redhat.com/errata/RHSA-2018:3246
- https://access.redhat.com/security/cve/CVE-2017-18201
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=887640
- https://git.savannah.gnu.org/cgit/libcdio.git/commit/?id=f6f9c48fb40b8a1e8218799724b0b61a7161eb1d
- https://linux.oracle.com/cve/CVE-2017-18201.html
- https://linux.oracle.com/errata/ELSA-2018-3246.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-18201