A double-free flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.
An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.
Created libcdio tracking bugs for this issue:
Affects: fedora-all [bug 1549713]
I am trying to understand the this bug tracking system.
When I read:
> Affects: fedora-all [bug 1549713]
What does "fedora-all" mean? As noted previously, the bug was introduced sometime after 0.90 (definitely in 0.94) but fixed in 2.0.0
I understand 'fedora-all' as all active releases. Currently that would be F26 and F27 with libcdio-0.94 and F-28 and rawhide with libcdio-2.0.0
I patched libcdio for F26 and F27. F28 and rawhide should be on the safe side with 2.0.0.
Thanks for the clarification. So I gather rawhide is not considered to be in "fedora-all"?
Not a big deal. I'm just trying to understand these things in detail and wondering about how accurate such trackers are. Since I happen to know what's up with this one, I'm can it as a gauge for other bug reports where I really have no idea.
I'm can it -> I can use it
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:3246 https://access.redhat.com/errata/RHSA-2018:3246