{"id":"CVE-2017-18201","aliases":["DEBIAN-CVE-2017-18201","EUVD-2017-9334","GHSA-8qcw-8m67-996h","MGASA-2018-0209","MGASA-2018-0225","RHSA-2018:3246","SUSE-SU-2018:0673-1","SUSE-SU-2018:2236-1","UBUNTU-CVE-2017-18201","openSUSE-SU-2024:10675-1"],"status":"published","title":"An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic...","description":"An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03269,"percentile":0.8848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2018-02-26T14:00:00Z","modified":"2026-10-24T10:50:10Z","fixes":[{"ecosystem":"Debian:12","package":"libcdio","fixed_in":["2.0.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcdio","fixed_in":["2.0.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcdio","fixed_in":["2.0.0-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"libcdio","fixed_in":["0.90-6.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-2"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.94-1.1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:5","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.92-3.1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcdio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcdio-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcdio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcdio-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcdio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcdio-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcdio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcdio-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"libcdio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.94-6.3.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"libcdio"}],"references":[{"url":"http://www.securityfocus.com/bid/103190","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://git.savannah.gnu.org/cgit/libcdio.git/commit/?id=f6f9c48fb40b8a1e8218799724b0b61a7161eb1d","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3246","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18201","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8qcw-8m67-996h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-18201","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0209.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22740","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NHBEK7JWO4GCS73UAOQOUFGTMIIMYYTR/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0225.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22902","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549707","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3246.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18198","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18198","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18199","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18199","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18201","tags":["advisory","report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=887640","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180673-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082877","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18201","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182236-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082821","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18199","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-18201","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18198","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-18201","description":"An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.","status":"published","published":"2018-02-26T14:00:00Z","modified":"2024-08-05T21:13:49.039Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2017-9334","description":"An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.","status":"published","published":"2018-02-26T14:00:00Z","modified":"2024-08-05T21:13:49Z","updated_at":"2026-11-03T02:23:07.6199Z"}],"ghsa":[{"id":"GHSA-8qcw-8m67-996h","title":"An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic...","description":"An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.","status":"published","published":"2022-05-14T02:03:26Z","modified":"2023-02-02T05:05:17Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:52:03.631935Z"}],"nvd":[{"id":"CVE-2017-18201","description":"An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.","status":"published","published":"2018-02-26T14:29:00.273Z","modified":"2026-06-17T01:12:22.97Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:04:15.877386Z"}],"osv":[{"id":"CVE-2017-18201","description":"An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.","status":"published","published":"2018-02-26T14:29:00.273Z","modified":"2026-11-09T10:30:53.879943095Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T10:53:57.550641Z"},{"id":"DEBIAN-CVE-2017-18201","description":"An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.","status":"published","published":"2018-02-26T14:29:00.273Z","modified":"2026-09-01T20:03:46.903880677Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"RHSA-2018:3246","title":"Red Hat Security Advisory: libcdio security update","status":"published","published":"2024-09-16T01:37:43Z","modified":"2026-06-26T10:39:35Z","cvss":[{"version":"3.0","score":3.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2017-18201","description":"An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.","status":"withdrawn","published":"2018-02-26T14:29:00Z","modified":"2025-07-16T07:36:30.317386Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"MGASA-2018-0209","title":"Updated libcdio packages fix security vulnerabilities","description":"A heap corruption bug was found in the way libcdio handled processing of\nISO files. An attacker could potentially use this flaw to crash\napplications using libcdio by tricking them into processing crafted ISO\nfiles, thus resulting in local DoS (CVE-2017-18198).\n\nA NULL pointer dereference flaw was found in the way libcdio handled\nprocessing of ISO files. An attacker could potentially use this flaw to\ncrash applications using libcdio by tricking them into processing\ncrafted ISO files (CVE-2017-18199).\n\nA double-free flaw was found in the way libcdio handled processing of\nISO files. An attacker could potentially use this flaw to crash\napplications using libcdio by tricking them into processing crafted ISO\nfiles (CVE-2017-18201).\n","status":"published","published":"2018-04-22T19:59:03Z","modified":"2026-04-16T06:25:47.259513518Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0225","title":"Updated libcdio packages fix security vulnerabilities","description":"A heap corruption bug was found in the way libcdio handled processing of\nISO files. An attacker could potentially use this flaw to crash\napplications using libcdio by tricking them into processing crafted ISO\nfiles, thus resulting in local DoS (CVE-2017-18198).\n\nA NULL pointer dereference flaw was found in the way libcdio handled\nprocessing of ISO files. An attacker could potentially use this flaw to\ncrash applications using libcdio by tricking them into processing\ncrafted ISO files (CVE-2017-18199).\n\nA double-free flaw was found in the way libcdio handled processing of\nISO files. An attacker could potentially use this flaw to crash\napplications using libcdio by tricking them into processing crafted ISO\nfiles (CVE-2017-18201).\n","status":"published","published":"2018-05-09T18:33:09Z","modified":"2026-04-16T06:24:53.076370549Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10675-1","title":"libcdio++0-2.1.0-2.6 on GA media","description":"These are all security issues fixed in the libcdio++0-2.1.0-2.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:20.255152Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:0673-1","title":"Security update for libcdio","description":"This update for libcdio fixes the following issues:\n\n- CVE-2017-18201: Fixed a double free vulnerability (bsc#1082877).\n","status":"published","published":"2018-03-14T16:03:22Z","modified":"2026-02-04T02:14:25.738752Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:2236-1","title":"Security update for libcdio","description":"This update for libcdio fixes the following issues:\n\nThe following security vulnerabilities were addressed:\n\n- CVE-2017-18199: Fixed a NULL pointer dereference in realloc_symlink in rock.c\n  (bsc#1082821)\n- CVE-2017-18201: Fixed a double free vulnerability in get_cdtext_generic() in\n  _cdio_generic.c (bsc#1082877)\n- Fixed several memory leaks (bsc#1082821)\n","status":"published","published":"2018-08-07T10:48:04Z","modified":"2026-02-04T03:47:25.061769Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}