{"id":"CVE-2017-18199","aliases":["DEBIAN-CVE-2017-18199","EUVD-2017-9332","GHSA-g22c-3rrr-vfp7","MGASA-2018-0209","MGASA-2018-0225","RHSA-2018:3246","SUSE-SU-2018:2236-1","SUSE-SU-2020:14498-1","SUSE-SU-2020:3023-1","UBUNTU-CVE-2017-18199","USN-5558-1","openSUSE-SU-2024:10675-1"],"status":"published","title":"realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial...","description":"realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03255,"percentile":0.8844,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2018-02-24T06:00:00Z","modified":"2026-09-01T20:03:46Z","fixes":[{"ecosystem":"Debian:12","package":"libcdio","fixed_in":["1.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcdio","fixed_in":["1.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcdio","fixed_in":["1.0.0-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libcdio","fixed_in":["0.80-8.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libcdio","fixed_in":["0.90-6.6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libcdio","fixed_in":["0.90-6.6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libcdio","fixed_in":["0.90-6.6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"libcdio","fixed_in":["0.90-6.6.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcdio","fixed_in":["0.83-4.1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcdio","fixed_in":["0.83-4.2ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.94-1.1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:5","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.92-3.1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcdio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcdio-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcdio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcdio-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcdio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcdio-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcdio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcdio-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.94-6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.80-8.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.6.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.83-4.1ubuntu1+esm1"}]}],"versions":["0.83-4ubuntu1","0.83-4.1","0.83-4.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.83-4.2ubuntu1+esm1"}]}],"versions":["0.83-4.2","0.83-4.2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.83-4.1ubuntu1+esm1"}]}],"versions":["0.83-4ubuntu1","0.83-4.1","0.83-4.1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.83-4.2ubuntu1+esm1"}]}],"versions":["0.83-4.2","0.83-4.2ubuntu1"],"bundled":2}],"products":[{"vendor":"gnu","product":"libcdio"}],"references":[{"url":"https://savannah.gnu.org/bugs/?52264","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"http://ftp.gnu.org/gnu/libcdio/libcdio-1.0.0.tar.gz","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3246","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/103202","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18199","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g22c-3rrr-vfp7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-18199","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0209.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22740","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NHBEK7JWO4GCS73UAOQOUFGTMIIMYYTR/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0225.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22902","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549707","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3246.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18198","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18198","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18199","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18199","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18201","tags":["advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=887640","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182236-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082821","tags":["report"]},{"url":"https://bugzilla.suse.com/1082877","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18201","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014498-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203023-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-18199","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5558-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-18198","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18198","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-18199","description":"realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.","status":"published","published":"2018-02-24T06:00:00Z","modified":"2024-08-05T21:13:49.153Z","updated_at":"2026-11-02T14:33:22.064284Z"}],"euvd":[{"id":"EUVD-2017-9332","description":"realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.","status":"published","published":"2018-02-24T06:00:00Z","modified":"2024-08-05T21:13:49Z","updated_at":"2026-11-03T02:23:07.6199Z"}],"ghsa":[{"id":"GHSA-g22c-3rrr-vfp7","title":"realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial...","description":"realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.","status":"published","published":"2022-05-14T02:03:26Z","modified":"2023-02-02T05:05:16Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:52:03.631935Z"}],"nvd":[{"id":"CVE-2017-18199","description":"realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.","status":"published","published":"2018-02-24T06:29:00.32Z","modified":"2026-06-17T01:12:22.73Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:15.877386Z"}],"osv":[{"id":"CVE-2017-18199","description":"realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.","status":"published","published":"2018-02-24T06:29:00.32Z","modified":"2026-04-16T06:21:36.787844184Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-18199","description":"realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.","status":"published","published":"2018-02-24T06:29:00.32Z","modified":"2026-09-01T20:03:46.919527938Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"RHSA-2018:3246","title":"Red Hat Security Advisory: libcdio security update","status":"published","published":"2024-09-16T01:37:43Z","modified":"2026-06-26T10:39:35Z","cvss":[{"version":"3.0","score":3.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2017-18199","description":"realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.","status":"published","published":"2018-02-24T06:29:00Z","modified":"2026-04-22T11:20:52.902779Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"MGASA-2018-0209","title":"Updated libcdio packages fix security vulnerabilities","description":"A heap corruption bug was found in the way libcdio handled processing of\nISO files. An attacker could potentially use this flaw to crash\napplications using libcdio by tricking them into processing crafted ISO\nfiles, thus resulting in local DoS (CVE-2017-18198).\n\nA NULL pointer dereference flaw was found in the way libcdio handled\nprocessing of ISO files. An attacker could potentially use this flaw to\ncrash applications using libcdio by tricking them into processing\ncrafted ISO files (CVE-2017-18199).\n\nA double-free flaw was found in the way libcdio handled processing of\nISO files. An attacker could potentially use this flaw to crash\napplications using libcdio by tricking them into processing crafted ISO\nfiles (CVE-2017-18201).\n","status":"published","published":"2018-04-22T19:59:03Z","modified":"2026-04-16T06:25:47.259513518Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0225","title":"Updated libcdio packages fix security vulnerabilities","description":"A heap corruption bug was found in the way libcdio handled processing of\nISO files. An attacker could potentially use this flaw to crash\napplications using libcdio by tricking them into processing crafted ISO\nfiles, thus resulting in local DoS (CVE-2017-18198).\n\nA NULL pointer dereference flaw was found in the way libcdio handled\nprocessing of ISO files. An attacker could potentially use this flaw to\ncrash applications using libcdio by tricking them into processing\ncrafted ISO files (CVE-2017-18199).\n\nA double-free flaw was found in the way libcdio handled processing of\nISO files. An attacker could potentially use this flaw to crash\napplications using libcdio by tricking them into processing crafted ISO\nfiles (CVE-2017-18201).\n","status":"published","published":"2018-05-09T18:33:09Z","modified":"2026-04-16T06:24:53.076370549Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10675-1","title":"libcdio++0-2.1.0-2.6 on GA media","description":"These are all security issues fixed in the libcdio++0-2.1.0-2.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:20.255152Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:2236-1","title":"Security update for libcdio","description":"This update for libcdio fixes the following issues:\n\nThe following security vulnerabilities were addressed:\n\n- CVE-2017-18199: Fixed a NULL pointer dereference in realloc_symlink in rock.c\n  (bsc#1082821)\n- CVE-2017-18201: Fixed a double free vulnerability in get_cdtext_generic() in\n  _cdio_generic.c (bsc#1082877)\n- Fixed several memory leaks (bsc#1082821)\n","status":"published","published":"2018-08-07T10:48:04Z","modified":"2026-02-04T03:47:25.061769Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2020:14498-1","title":"Security update for libcdio","description":"This update for libcdio and libcdio-mini fixes the following issues:\n\nSecurity issue fixed: \n\n- CVE-2017-18199: Fixed a NULL Pointer Dereference in realloc_symlink which could allow remote attackers to cause Denial of Service (bsc#1082821).\n","status":"published","published":"2020-09-23T13:59:23Z","modified":"2026-02-04T04:39:15.838551Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:3023-1","title":"Security update for libcdio","description":"This update for libcdio fixes the following issues:\n\nThe following security vulnerability was addressed:\n\n- CVE-2017-18199: Fixed a NULL pointer dereference in  realloc_symlink in\n  rock.c, which allowed remote attackers to cause a denial of service via a\n  crafted ISO file. (bsc#1082821)\n","status":"published","published":"2020-10-23T12:21:45Z","modified":"2026-02-04T02:32:34.859373Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-5558-1","title":"libcdio vulnerabilities","description":"Zhao Liang discovered that libcdio was not properly performing memory\nmanagement operations when processing ISO files, which could result\nin a heap buffer overflow or in a NULL pointer dereference. If a user\nor automated system were tricked into opening a specially crafted file,\nan attacker could possibly use this issue to cause a denial of service.\n(CVE-2017-18198, CVE-2017-18199)\n","status":"published","published":"2022-08-10T09:50:19Z","modified":"2026-06-29T13:49:40.131577057Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}