Every CVE Search/ Get API key

CVE-2017-18198

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause...

8.8 HighFix available

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.35%Up 1.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.

Record
CVE-2017-18198
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.

Record
CVE-2017-18198
Updated
2026-11-02
EUVDEUVD-2017-9331 No score

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.

Record
EUVD-2017-9331
Updated
2026-11-03
GitHub AdvisoriesGHSA-6wcx-ghh6-m249 8.8

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause...

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.

Record
GHSA-6wcx-ghh6-m249
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 8.8

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.

Record
CVE-2017-18198
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-18198 8.8

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.

Record
DEBIAN-CVE-2017-18198
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2018:3246 3.9

Red Hat Security Advisory: libcdio security update

Record
RHSA-2018:3246
CVSS 3.0
3.9 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2017-18198 8.8

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.

Record
UBUNTU-CVE-2017-18198
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2018-0209 No score

Updated libcdio packages fix security vulnerabilities

A heap corruption bug was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files, thus resulting in local DoS (CVE-2017-18198).

A NULL pointer dereference flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files (CVE-2017-18199).

A double-free flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files (CVE-2017-18201).

Record
MGASA-2018-0209
Updated
2026-11-02
OSVMGASA-2018-0225 No score

Updated libcdio packages fix security vulnerabilities

A heap corruption bug was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files, thus resulting in local DoS (CVE-2017-18198).

A NULL pointer dereference flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files (CVE-2017-18199).

A double-free flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files (CVE-2017-18201).

Record
MGASA-2018-0225
Updated
2026-11-02
OSVopenSUSE-SU-2024:10675-1 No score

libcdio++0-2.1.0-2.6 on GA media

These are all security issues fixed in the libcdio++0-2.1.0-2.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10675-1
Updated
2026-11-02
OSVUSN-5558-1 No score

libcdio vulnerabilities

Zhao Liang discovered that libcdio was not properly performing memory management operations when processing ISO files, which could result in a heap buffer overflow or in a NULL pointer dereference. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2017-18198, CVE-2017-18199)

Record
USN-5558-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libcdio
Debian:12
 before 1.0.0-1
1.0.0-1
libcdio
Debian:13
 before 1.0.0-1
1.0.0-1
libcdio
Debian:14
 before 1.0.0-1
1.0.0-1
libcdio
Mageia:6
From an advisory covering 3 CVEs
 before 0.94-1.1.mga6
0.94-1.1.mga6
libcdio
Mageia:5
From an advisory covering 3 CVEs
 before 0.92-3.1.mga5
0.92-3.1.mga5
libcdio
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
Show 11 moreShow less
Affected packages
PackageAffectedFixed
libcdio-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:0.92-3.el7
0:0.92-3.el7
libcdio
Ubuntu:Pro:14.04:LTS
 before 0.83-4.1ubuntu1+esm1, plus listed versions
0.83-4ubuntu10.83-4.10.83-4.1ubuntu1
0.83-4.1ubuntu1+esm1
libcdio
Ubuntu:Pro:16.04:LTS
 before 0.83-4.2ubuntu1+esm1, plus listed versions
0.83-4.20.83-4.2ubuntu1
0.83-4.2ubuntu1+esm1
libcdio
Ubuntu:Pro:14.04:LTS
From an advisory covering 2 CVEs
 before 0.83-4.1ubuntu1+esm1, plus listed versions
0.83-4ubuntu10.83-4.10.83-4.1ubuntu1
0.83-4.1ubuntu1+esm1
libcdio
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 0.83-4.2ubuntu1+esm1, plus listed versions
0.83-4.20.83-4.2ubuntu1
0.83-4.2ubuntu1+esm1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-18198 is a high vulnerability (CVSS 8.8) in Gnu Libcdio, published February 24, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.35%, the 88th percentile. Fixed in libcdio 1.0.0-1.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open