CriticalCVSS 9.8
An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.
Product
GNU libcdio vulnerabilities
4 published CVES affecting GNU libcdio, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 4
- Critical
- 1
- High
- 1
- Medium
- 2
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest GNU libcdio CVEs
Newest publication first
-
-
MediumCVSS 6.5
realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.
-
HighCVSS 8.8
print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.
-
MediumCVSS 5.0 EPSS 12.7%
Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.