ALAS2-2019-1151


Amazon Linux 2 Security Advisory: ALAS-2019-1151
Advisory Release Date: 2019-01-25 00:58 Pacific
Severity: Low

Issue Overview:

A heap corruption bug was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files, thus resulting in local DoS.(CVE-2017-18198 )

A double-free flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.(CVE-2017-18201 )

A NULL pointer dereference flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.(CVE-2017-18199 )


Affected Packages:

libcdio


Issue Correction:
Run yum update libcdio to update your system.

New Packages:
aarch64:
    libcdio-0.92-3.amzn2.aarch64
    libcdio-devel-0.92-3.amzn2.aarch64
    libcdio-debuginfo-0.92-3.amzn2.aarch64

i686:
    libcdio-0.92-3.amzn2.i686
    libcdio-devel-0.92-3.amzn2.i686
    libcdio-debuginfo-0.92-3.amzn2.i686

src:
    libcdio-0.92-3.amzn2.src

x86_64:
    libcdio-0.92-3.amzn2.x86_64
    libcdio-devel-0.92-3.amzn2.x86_64
    libcdio-debuginfo-0.92-3.amzn2.x86_64