ALAS2-2019-1151

Amazon Linux 2 Security Advisory: ALAS-2019-1151
Advisory Release Date: 2019-01-23 23:25 Pacific
Advisory Updated Date: 2019-01-25 00:58 Pacific
Severity: Low
Issue Overview:

A heap corruption bug was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files, thus resulting in local DoS.(CVE-2017-18198)

A double-free flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.(CVE-2017-18201)

A NULL pointer dereference flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.(CVE-2017-18199)


Affected Packages:

libcdio


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update libcdio to update your system.

New Packages:
aarch64:
    libcdio-0.92-3.amzn2.aarch64
    libcdio-devel-0.92-3.amzn2.aarch64
    libcdio-debuginfo-0.92-3.amzn2.aarch64

i686:
    libcdio-0.92-3.amzn2.i686
    libcdio-devel-0.92-3.amzn2.i686
    libcdio-debuginfo-0.92-3.amzn2.i686

src:
    libcdio-0.92-3.amzn2.src

x86_64:
    libcdio-0.92-3.amzn2.x86_64
    libcdio-devel-0.92-3.amzn2.x86_64
    libcdio-debuginfo-0.92-3.amzn2.x86_64

Additional References

Red Hat: CVE-2017-18198, CVE-2017-18199, CVE-2017-18201

Mitre: CVE-2017-18198, CVE-2017-18199, CVE-2017-18201