Security update for libcdio SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2236-1 Final 1 1 2018-08-07T10:48:04Z current 2018-08-07T10:48:04Z 2018-08-07T10:48:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libcdio This update for libcdio fixes the following issues: The following security vulnerabilities were addressed: - CVE-2017-18199: Fixed a NULL pointer dereference in realloc_symlink in rock.c (bsc#1082821) - CVE-2017-18201: Fixed a double free vulnerability in get_cdtext_generic() in _cdio_generic.c (bsc#1082877) - Fixed several memory leaks (bsc#1082821) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Desktop-Applications-15-2018-1512 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182236-1/ Link for SUSE-SU-2018:2236-1 https://lists.suse.com/pipermail/sle-security-updates/2018-August/004383.html E-Mail link for SUSE-SU-2018:2236-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1082821 SUSE Bug 1082821 https://bugzilla.suse.com/1082877 SUSE Bug 1082877 https://www.suse.com/security/cve/CVE-2017-18199/ SUSE CVE CVE-2017-18199 page https://www.suse.com/security/cve/CVE-2017-18201/ SUSE CVE CVE-2017-18201 page SUSE Linux Enterprise Module for Desktop Applications 15 libcdio++0-0.94-6.3.1 libcdio-devel-0.94-6.3.1 libcdio16-0.94-6.3.1 libiso9660-10-0.94-6.3.1 libudf0-0.94-6.3.1 libcdio++0-0.94-6.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libcdio-devel-0.94-6.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libcdio16-0.94-6.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libiso9660-10-0.94-6.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libudf0-0.94-6.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file. CVE-2017-18199 SUSE Linux Enterprise Module for Desktop Applications 15:libcdio++0-0.94-6.3.1 SUSE Linux Enterprise Module for Desktop Applications 15:libcdio-devel-0.94-6.3.1 SUSE Linux Enterprise Module for Desktop Applications 15:libcdio16-0.94-6.3.1 SUSE Linux Enterprise Module for Desktop Applications 15:libiso9660-10-0.94-6.3.1 SUSE Linux Enterprise Module for Desktop Applications 15:libudf0-0.94-6.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182236-1/ https://www.suse.com/security/cve/CVE-2017-18199.html CVE-2017-18199 https://bugzilla.suse.com/1082821 SUSE Bug 1082821 An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c. CVE-2017-18201 SUSE Linux Enterprise Module for Desktop Applications 15:libcdio++0-0.94-6.3.1 SUSE Linux Enterprise Module for Desktop Applications 15:libcdio-devel-0.94-6.3.1 SUSE Linux Enterprise Module for Desktop Applications 15:libcdio16-0.94-6.3.1 SUSE Linux Enterprise Module for Desktop Applications 15:libiso9660-10-0.94-6.3.1 SUSE Linux Enterprise Module for Desktop Applications 15:libudf0-0.94-6.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182236-1/ https://www.suse.com/security/cve/CVE-2017-18201.html CVE-2017-18201 https://bugzilla.suse.com/1082877 SUSE Bug 1082877