USN-5558-1: libcdio vulnerabilities

Packages

libcdio - library to read and control digital audio CDs (development files)

Details

Zhao Liang discovered that libcdio was not properly performing memory
management operations when processing ISO files, which could result
in a heap buffer overflow or in a NULL pointer dereference. If a user
or automated system were tricked into opening a specially crafted file,
an attacker could possibly use this issue to cause a denial of service.
(CVE-2017-18198, CVE-2017-18199)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
16.04 xenial	libcdio-paranoia1 – 0.83-4.2ubuntu1+esm1
	libcdio-cdda1 – 0.83-4.2ubuntu1+esm1
	libcdio-utils – 0.83-4.2ubuntu1+esm1
	libcdio13 – 0.83-4.2ubuntu1+esm1
	libiso9660-8 – 0.83-4.2ubuntu1+esm1
	libudf0 – 0.83-4.2ubuntu1+esm1
14.04 trusty	libcdio-paranoia1 – 0.83-4.1ubuntu1+esm1
	libcdio-cdda1 – 0.83-4.1ubuntu1+esm1
	libcdio-utils – 0.83-4.1ubuntu1+esm1
	libcdio13 – 0.83-4.1ubuntu1+esm1
	libiso9660-8 – 0.83-4.1ubuntu1+esm1
	libudf0 – 0.83-4.1ubuntu1+esm1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References