GNU Libcdio vulnerabilities

5 CVEs affecting GNU Libcdio, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-36600, published 2024-06-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2007-6613, published 2008-01-03. Medium severity, CVSS 5.0. EPSS: 12.7% chance of exploitation in the next 30 days. Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent…
CVE-2017-18198, published 2018-02-24. High severity, CVSS 8.8. EPSS: 3.3% chance of exploitation in the next 30 days. print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a…
CVE-2017-18201, published 2018-02-26. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.
CVE-2017-18199, published 2018-02-24. Medium severity, CVSS 6.5. EPSS: 3.3% chance of exploitation in the next 30 days. realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.
CVE-2024-36600, published 2024-06-14. High severity, CVSS 8.4. EPSS: 0.4% chance of exploitation in the next 30 days. Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.