NULL pointer dereference in libcdio - CVE-2017-18199

Vulnerability identifier: #VU10796

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-18199

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the realloc_symlink function due to improper handling of crafted ISO image files. A remote attacker can create a specially crafted ISO image file, trick the victim into opening it and cause the service to crash.

libcdio
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Ubuntu
Opensuse
Fedora
libcdio
libcdio-paranoia1 (Ubuntu package)
libcdio-cdda1 (Ubuntu package)
libcdio-utils (Ubuntu package)
libcdio13 (Ubuntu package)
libiso9660-8 (Ubuntu package)
libudf0 (Ubuntu package)

Update to version 1.0.0.

libcdio - addressed in versions 0.94-5.fc26, 0.94-5.fc27
libcdio-paranoia1 (Ubuntu package) - update to 0.834.2ubuntu1+esm1
libcdio-cdda1 (Ubuntu package) - update to 0.834.2ubuntu1+esm1
libcdio-utils (Ubuntu package) - update to 0.834.2ubuntu1+esm1
libcdio13 (Ubuntu package) - update to 0.834.2ubuntu1+esm1
libiso9660-8 (Ubuntu package) - update to 0.834.2ubuntu1+esm1
libudf0 (Ubuntu package) - update to 0.834.2ubuntu1+esm1

• https://savannah.gnu.org/bugs/?52264

• Denial of service in libcdio
• OpenSUSE Linux update for libcdio
• Red Hat update for libcdio
• Ubuntu update for libcdio
• Fedora 27 update for libcdio
• Fedora 26 update for libcdio