USN-6855-1: libcdio vulnerability
Published Jun 28, 2024
·Updated
Mansour Gashasbi discovered that libcdio incorrectly handled certain memory operations when parsing an ISO file, leading to a buffer overflow vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code.
Affected Software
54 affected componentsFixes available
All of the following
ubuntu/libcdio++1t64<2.1.0-4.1ubuntu1.2
2.1.0-4.1ubuntu1.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libcdio19t64<2.1.0-4.1ubuntu1.2
2.1.0-4.1ubuntu1.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libiso9660++0t64<2.1.0-4.1ubuntu1.2
2.1.0-4.1ubuntu1.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libiso9660-11t64<2.1.0-4.1ubuntu1.2
2.1.0-4.1ubuntu1.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libudf0t64<2.1.0-4.1ubuntu1.2
2.1.0-4.1ubuntu1.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libcdio++1<2.1.0-4ubuntu0.2
2.1.0-4ubuntu0.2
Ubuntu Ubuntu=23.10
All of the following
ubuntu/libcdio19<2.1.0-4ubuntu0.2
2.1.0-4ubuntu0.2
Ubuntu Ubuntu=23.10
All of the following
ubuntu/libiso9660++0<2.1.0-4ubuntu0.2
2.1.0-4ubuntu0.2
Ubuntu Ubuntu=23.10
All of the following
ubuntu/libiso9660-11<2.1.0-4ubuntu0.2
2.1.0-4ubuntu0.2
Ubuntu Ubuntu=23.10
All of the following
ubuntu/libudf0<2.1.0-4ubuntu0.2
2.1.0-4ubuntu0.2
Ubuntu Ubuntu=23.10
All of the following
ubuntu/libcdio++1<2.1.0-3ubuntu0.2
2.1.0-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libcdio19<2.1.0-3ubuntu0.2
2.1.0-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libiso9660++0<2.1.0-3ubuntu0.2
2.1.0-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libiso9660-11<2.1.0-3ubuntu0.2
2.1.0-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libudf0<2.1.0-3ubuntu0.2
2.1.0-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libcdio18<2.0.0-2ubuntu0.2
2.0.0-2ubuntu0.2
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libiso9660-11<2.0.0-2ubuntu0.2
2.0.0-2ubuntu0.2
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libudf0<2.0.0-2ubuntu0.2
2.0.0-2ubuntu0.2
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libcdio17<1.0.0-2ubuntu2+esm2
1.0.0-2ubuntu2+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libiso9660-10<1.0.0-2ubuntu2+esm2
1.0.0-2ubuntu2+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libudf0<1.0.0-2ubuntu2+esm2
1.0.0-2ubuntu2+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libcdio13<0.83-4.2ubuntu1+esm3
0.83-4.2ubuntu1+esm3
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libiso9660-8<0.83-4.2ubuntu1+esm3
0.83-4.2ubuntu1+esm3
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libudf0<0.83-4.2ubuntu1+esm3
0.83-4.2ubuntu1+esm3
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libcdio13<0.83-4.1ubuntu1+esm3
0.83-4.1ubuntu1+esm3
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libiso9660-8<0.83-4.1ubuntu1+esm3
0.83-4.1ubuntu1+esm3
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libudf0<0.83-4.1ubuntu1+esm3
0.83-4.1ubuntu1+esm3
Ubuntu Ubuntu=14.04
Event History
Jun 28, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-6855-1?
The severity of USN-6855-1 is high due to the potential for denial of service and arbitrary code execution.
2
How do I fix USN-6855-1?
To fix USN-6855-1, update the affected packages to the specified version 2.1.0-4.1ubuntu1.2 or higher.
3
Which Ubuntu versions are affected by USN-6855-1?
USN-6855-1 affects Ubuntu versions 16.04, 18.04, 20.04, 22.04, 23.10, and 24.04.
4
What are the affected packages in USN-6855-1?
The affected packages in USN-6855-1 include libcdio++, libcdio, libiso9660++, libiso9660, and libudf.
5
Who discovered the vulnerability in USN-6855-1?
The vulnerability in USN-6855-1 was discovered by Mansour Gashasbi.