Vulnerability-Lookup

CVE-2024-36600 (GCVE-0-2024-36600)

Vulnerability from cvelistv5 – Published: 2024-06-14 00:00 – Updated: 2026-01-20 20:04

Summary

Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-14 19:58 UTC

CWE

n/a
CWE-121 - Stack-based Buffer Overflow

Assigner

mitre mitre root

References

4 references

URL	Tags
https://github.com/gashasbi/My-Reports/tree/main/…
https://bugzilla.redhat.com/show_bug.cgi?id=2292833
https://github.com/libcdio/libcdio/pull/32
https://github.com/libcdio/libcdio/pull/46

Impacted products

1 product

Vendor	Product	Version	CPE status
gnu	libcdio	Affected: 2.1.0 cpe:2.3:a:gnu:libcdio:2.1.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:gnu:libcdio:2.1.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "libcdio",
            "vendor": "gnu",
            "versions": [
              {
                "status": "affected",
                "version": "2.1.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36600",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T19:58:14.360916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-121",
                "description": "CWE-121 Stack-based Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-14T20:01:57.509Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:37:05.356Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-20T20:04:11.488Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292833"
        },
        {
          "url": "https://github.com/libcdio/libcdio/pull/32"
        },
        {
          "url": "https://github.com/libcdio/libcdio/pull/46"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-36600",
    "datePublished": "2024-06-14T00:00:00.000Z",
    "dateReserved": "2024-05-30T00:00:00.000Z",
    "dateUpdated": "2026-01-20T20:04:11.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36600",
      "date": "2026-09-21",
      "epss": "0.0036",
      "percentile": "0.29704"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file."
        },
        {
          "lang": "es",
          "value": "La vulnerabilidad de desbordamiento de b\u00fafer en libcdio v2.1.0 permite a un atacante ejecutar c\u00f3digo arbitrario a trav\u00e9s de un archivo de imagen ISO 9660 manipulado."
        }
      ],
      "id": "CVE-2024-36600",
      "lastModified": "2024-11-21T09:22:28.260",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.5,
            "impactScore": 5.9,
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-06-14T19:15:50.967",
      "references": [
        {
          "source": "cve@mitre.org",
          "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-121"
            }
          ],
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "n/a",
                "vendor": "n/a",
                "versions": [
                  {
                    "status": "affected",
                    "version": "n/a"
                  }
                ]
              }
            ],
            "source": "cve@mitre.org"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:gnu:libcdio:2.1.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "libcdio",
                "vendor": "gnu",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.1.0"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:gnu:libcdio:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F6ECB3A8-51A1-4574-A821-AA0D861E23FF",
                    "versionEndExcluding": "2.3.0",
                    "versionStartIncluding": "2.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file."
          },
          {
            "lang": "es",
            "value": "La vulnerabilidad de desbordamiento de b\u00fafer en libcdio v2.1.0 permite a un atacante ejecutar c\u00f3digo arbitrario a trav\u00e9s de un archivo de imagen ISO 9660 manipulado."
          }
        ],
        "id": "CVE-2024-36600",
        "lastModified": "2026-06-17T07:37:00.963",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-36600",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T19:58:14.360916Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-06-14T19:15:50.967",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292833"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://github.com/libcdio/libcdio/pull/32"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://github.com/libcdio/libcdio/pull/46"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-121"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:32:58+00:00",
      "cve": "CVE-2024-36600",
      "id": "CVE-2024-36600",
      "initial_release_date": "2024-06-14T00:00:00+00:00",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libcdio: crafted iso image file leads to arbitrary code execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36600.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-01-22T00:40:47Z",
      "cve": "CVE-2024-36600",
      "id": "CVE-2024-36600",
      "initial_release_date": "2024-06-18T02:44:13Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36600",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36600.json",
      "version": "11"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:37:05.356Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:gnu:libcdio:2.1.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "libcdio",
                "vendor": "gnu",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.1.0"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 8.4,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-36600",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-14T19:58:14.360916Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-121",
                    "description": "CWE-121 Stack-based Buffer Overflow",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-14T19:59:38.385Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n/a",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "n/a",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-01-20T20:04:11.488Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
            },
            {
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292833"
            },
            {
              "url": "https://github.com/libcdio/libcdio/pull/32"
            },
            {
              "url": "https://github.com/libcdio/libcdio/pull/46"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2024-36600",
        "datePublished": "2024-06-14T00:00:00.000Z",
        "dateReserved": "2024-05-30T00:00:00.000Z",
        "dateUpdated": "2026-01-20T20:04:11.488Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2024-04922 (CVE-2024-36600)

Vulnerability from fstec – Published: 2024-07-02 – Updated: 2026-01-27 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость компонента ISO 9660 Image File Handler библиотеки libcdio, позволяющая нарушителю выполнить произвольный код

Summary

Уязвимость компонента ISO 9660 Image File Handler библиотеки libcdio связана с переполнения буфера. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:N/C:C/I:C/A:P

7.3 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-120 - Копирование буфера без проверки размера входных данных (классическое переполнение буфера)

Aliases

CVE-2024-36600

References

5 references

URL
https://git.savannah.gnu.org/cgit/libcdio.git/commit/?id=4c840665c6d9cf2ff1cf0c…
https://lists.gnu.org/archive/html/libcdio-devel/2024-04/msg00000.html
https://redos.red-soft.ru/support/secure/
https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600
https://altsp.su/obnovleniya-bezopasnosti/

Impacted products

3 products from 3 vendors

Vendors

ООО «Ред Софт», АО «ИВК», Сообщество свободного программного обеспечения

Products

РЕД ОС (запись в едином реестре российских программ №3751), АЛЬТ СП 10, libcdio

Versions

7.3 (РЕД ОС), - (АЛЬТ СП 10), 2.1.0 (libcdio)

Product types

Operating system, Application software

Platforms

ООО «Ред Софт» РЕД ОС 7.3 (запись в едином реестре российских программ №3751), АО «ИВК» АЛЬТ СП 10 -

Mitigations

Для libcdio: https://git.savannah.gnu.org/cgit/libcdio.git/commit/?id=4c840665c6d9cf2ff1cf0cd12f91b25030776c74 https://lists.gnu.org/archive/html/libcdio-devel/2024-04/msg00000.html Для РедОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/ Для ОС АЛЬТ СП 10: установка обновления из публичного репозитория программного средства: https://altsp.su/obnovleniya-bezopasnosti/

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:N/C:C/I:C/A:P",
  "CVSS 3.0": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb, \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7.3 (\u0420\u0415\u0414 \u041e\u0421), - (\u0410\u041b\u042c\u0422 \u0421\u041f 10), 2.1.0 (libcdio)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0414\u043b\u044f libcdio:\nhttps://git.savannah.gnu.org/cgit/libcdio.git/commit/?id=4c840665c6d9cf2ff1cf0cd12f91b25030776c74\nhttps://lists.gnu.org/archive/html/libcdio-devel/2024-04/msg00000.html\n\n\u0414\u043b\u044f \u0420\u0435\u0434\u041e\u0421: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/\n\n\u0414\u043b\u044f \u041e\u0421 \u0410\u041b\u042c\u0422 \u0421\u041f 10: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430: https://altsp.su/obnovleniya-bezopasnosti/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "14.06.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "27.01.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "02.07.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-04922",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-36600",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "\u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u0410\u041b\u042c\u0422 \u0421\u041f 10, libcdio",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb \u0410\u041b\u042c\u0422 \u0421\u041f 10 - ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 ISO 9660 Image File Handler \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libcdio, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (\u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430) (CWE-120)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 ISO 9660 Image File Handler \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libcdio \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.savannah.gnu.org/cgit/libcdio.git/commit/?id=4c840665c6d9cf2ff1cf0cd12f91b25030776c74\nhttps://lists.gnu.org/archive/html/libcdio-devel/2024-04/msg00000.html\nhttps://redos.red-soft.ru/support/secure/\nhttps://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600\nhttps://altsp.su/obnovleniya-bezopasnosti/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-120",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,3)"
}

CNVD-2025-15360

Vulnerability from cnvd - Published: 2025-07-09

Title

GNU libcdio缓冲区溢出漏洞

Description

GNU libcdio是GNU项目开发的用于访问CD-ROM和CD镜像的函数库，主要用于处理光盘文件系统的读取、目录结构解析等功能。 GNU libcdio存在缓冲区溢出漏洞，攻击者可利用该漏洞通过精心设计的ISO 9660镜像文件执行任意代码。

Severity

高

Patch Name

GNU libcdio缓冲区溢出漏洞的补丁

Patch Description

GNU libcdio是GNU项目开发的用于访问CD-ROM和CD镜像的函数库，主要用于处理光盘文件系统的读取、目录结构解析等功能。 GNU libcdio存在缓冲区溢出漏洞，攻击者可利用该漏洞通过精心设计的ISO 9660镜像文件执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网： https://git.savannah.gnu.org/cgit/libcdio.git/tree/lib/iso9660/iso9660_fs.c#n814

Reference

https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600

Impacted products

Name
Gnu GNU libcdio v2.1.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-36600",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-36600"
    }
  },
  "description": "GNU libcdio\u662fGNU\u9879\u76ee\u5f00\u53d1\u7684\u7528\u4e8e\u8bbf\u95eeCD-ROM\u548cCD\u955c\u50cf\u7684\u51fd\u6570\u5e93\uff0c\u4e3b\u8981\u7528\u4e8e\u5904\u7406\u5149\u76d8\u6587\u4ef6\u7cfb\u7edf\u7684\u8bfb\u53d6\u3001\u76ee\u5f55\u7ed3\u6784\u89e3\u6790\u7b49\u529f\u80fd\u3002\n\nGNU libcdio\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7cbe\u5fc3\u8bbe\u8ba1\u7684ISO 9660\u955c\u50cf\u6587\u4ef6\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://git.savannah.gnu.org/cgit/libcdio.git/tree/lib/iso9660/iso9660_fs.c#n814",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-15360",
  "openTime": "2025-07-09",
  "patchDescription": "GNU libcdio\u662fGNU\u9879\u76ee\u5f00\u53d1\u7684\u7528\u4e8e\u8bbf\u95eeCD-ROM\u548cCD\u955c\u50cf\u7684\u51fd\u6570\u5e93\uff0c\u4e3b\u8981\u7528\u4e8e\u5904\u7406\u5149\u76d8\u6587\u4ef6\u7cfb\u7edf\u7684\u8bfb\u53d6\u3001\u76ee\u5f55\u7ed3\u6784\u89e3\u6790\u7b49\u529f\u80fd\u3002\r\n\r\nGNU libcdio\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7cbe\u5fc3\u8bbe\u8ba1\u7684ISO 9660\u955c\u50cf\u6587\u4ef6\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "GNU libcdio\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Gnu GNU libcdio v2.1.0"
  },
  "referenceLink": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600",
  "serverity": "\u9ad8",
  "submitTime": "2024-06-21",
  "title": "GNU libcdio\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

FKIE_CVE-2024-36600

Vulnerability from fkie_nvd - Published: 2024-06-14 19:15 - Updated: 2026-06-17 07:37

Severity

8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.

References

URL	Tags
cve@mitre.org	https://bugzilla.redhat.com/show_bug.cgi?id=2292833	Third Party Advisory
cve@mitre.org	https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600	Exploit, Third Party Advisory
cve@mitre.org	https://github.com/libcdio/libcdio/pull/32	Issue Tracking
cve@mitre.org	https://github.com/libcdio/libcdio/pull/46	Issue Tracking
af854a3a-2127-422b-91ae-364da2661108	https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	gnu	libcdio	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:gnu:libcdio:2.1.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "libcdio",
          "vendor": "gnu",
          "versions": [
            {
              "status": "affected",
              "version": "2.1.0"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnu:libcdio:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6ECB3A8-51A1-4574-A821-AA0D861E23FF",
              "versionEndExcluding": "2.3.0",
              "versionStartIncluding": "2.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de desbordamiento de b\u00fafer en libcdio v2.1.0 permite a un atacante ejecutar c\u00f3digo arbitrario a trav\u00e9s de un archivo de imagen ISO 9660 manipulado."
    }
  ],
  "id": "CVE-2024-36600",
  "lastModified": "2026-06-17T07:37:00.963",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-36600",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-06-14T19:58:14.360916Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-06-14T19:15:50.967",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292833"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/libcdio/libcdio/pull/32"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/libcdio/libcdio/pull/46"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-89W5-XC64-FW9R

Vulnerability from github – Published: 2024-06-14 21:30 – Updated: 2026-01-20 21:31

Details

Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.

Severity

8.4 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-36600"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-14T19:15:50Z",
    "severity": "HIGH"
  },
  "details": "Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.",
  "id": "GHSA-89w5-xc64-fw9r",
  "modified": "2026-01-20T21:31:29Z",
  "published": "2024-06-14T21:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36600"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libcdio/libcdio/pull/32"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libcdio/libcdio/pull/46"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292833"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

UBUNTU-CVE-2024-36600 (CVE-2024-36600)

Vulnerability from osv_ubuntu – Published: 2024-06-14 19:15 – Updated: 2026-04-22 07:49 – Source website

Details

Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.

Severity

8.4 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-36600	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-36600	REPORT
	https://github.com/gashasbi/My-Reports/tree/main/…	REPORT
	https://lists.gnu.org/archive/html/libcdio-devel/…	REPORT
	https://lists.gnu.org/archive/html/libcdio-devel/…	REPORT
	https://ubuntu.com/security/notices/USN-6855-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libcdio-cdda1",
            "binary_version": "0.83-4.1ubuntu1+esm3"
          },
          {
            "binary_name": "libcdio-paranoia1",
            "binary_version": "0.83-4.1ubuntu1+esm3"
          },
          {
            "binary_name": "libcdio-utils",
            "binary_version": "0.83-4.1ubuntu1+esm3"
          },
          {
            "binary_name": "libcdio13",
            "binary_version": "0.83-4.1ubuntu1+esm3"
          },
          {
            "binary_name": "libiso9660-8",
            "binary_version": "0.83-4.1ubuntu1+esm3"
          },
          {
            "binary_name": "libudf0",
            "binary_version": "0.83-4.1ubuntu1+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "libcdio",
        "purl": "pkg:deb/ubuntu/libcdio@0.83-4.1ubuntu1+esm3?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.83-4.1ubuntu1+esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.83-4ubuntu1",
        "0.83-4.1",
        "0.83-4.1ubuntu1",
        "0.83-4.1ubuntu1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libcdio-cdda1",
            "binary_version": "0.83-4.2ubuntu1+esm3"
          },
          {
            "binary_name": "libcdio-paranoia1",
            "binary_version": "0.83-4.2ubuntu1+esm3"
          },
          {
            "binary_name": "libcdio-utils",
            "binary_version": "0.83-4.2ubuntu1+esm3"
          },
          {
            "binary_name": "libcdio13",
            "binary_version": "0.83-4.2ubuntu1+esm3"
          },
          {
            "binary_name": "libiso9660-8",
            "binary_version": "0.83-4.2ubuntu1+esm3"
          },
          {
            "binary_name": "libudf0",
            "binary_version": "0.83-4.2ubuntu1+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "libcdio",
        "purl": "pkg:deb/ubuntu/libcdio@0.83-4.2ubuntu1+esm3?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.83-4.2ubuntu1+esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.83-4.2",
        "0.83-4.2ubuntu1",
        "0.83-4.2ubuntu1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libcdio-utils",
            "binary_version": "1.0.0-2ubuntu2+esm2"
          },
          {
            "binary_name": "libcdio17",
            "binary_version": "1.0.0-2ubuntu2+esm2"
          },
          {
            "binary_name": "libiso9660-10",
            "binary_version": "1.0.0-2ubuntu2+esm2"
          },
          {
            "binary_name": "libudf0",
            "binary_version": "1.0.0-2ubuntu2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "libcdio",
        "purl": "pkg:deb/ubuntu/libcdio@1.0.0-2ubuntu2+esm2?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0-2ubuntu2+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.83-4.2ubuntu1",
        "0.94-0.2",
        "0.94-1",
        "1.0.0-2",
        "1.0.0-2ubuntu1",
        "1.0.0-2ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libcdio-utils",
            "binary_version": "2.0.0-2ubuntu0.2"
          },
          {
            "binary_name": "libcdio18",
            "binary_version": "2.0.0-2ubuntu0.2"
          },
          {
            "binary_name": "libiso9660-11",
            "binary_version": "2.0.0-2ubuntu0.2"
          },
          {
            "binary_name": "libudf0",
            "binary_version": "2.0.0-2ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libcdio",
        "purl": "pkg:deb/ubuntu/libcdio@2.0.0-2ubuntu0.2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0-2ubuntu0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libcdio++1",
            "binary_version": "2.1.0-3ubuntu0.2"
          },
          {
            "binary_name": "libcdio-utils",
            "binary_version": "2.1.0-3ubuntu0.2"
          },
          {
            "binary_name": "libcdio19",
            "binary_version": "2.1.0-3ubuntu0.2"
          },
          {
            "binary_name": "libiso9660++0",
            "binary_version": "2.1.0-3ubuntu0.2"
          },
          {
            "binary_name": "libiso9660-11",
            "binary_version": "2.1.0-3ubuntu0.2"
          },
          {
            "binary_name": "libudf0",
            "binary_version": "2.1.0-3ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libcdio",
        "purl": "pkg:deb/ubuntu/libcdio@2.1.0-3ubuntu0.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.0-3ubuntu0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.0-2",
        "2.1.0-2build1",
        "2.1.0-3",
        "2.1.0-3build1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libcdio++1t64",
            "binary_version": "2.1.0-4.1ubuntu1.2"
          },
          {
            "binary_name": "libcdio-utils",
            "binary_version": "2.1.0-4.1ubuntu1.2"
          },
          {
            "binary_name": "libcdio19t64",
            "binary_version": "2.1.0-4.1ubuntu1.2"
          },
          {
            "binary_name": "libiso9660++0t64",
            "binary_version": "2.1.0-4.1ubuntu1.2"
          },
          {
            "binary_name": "libiso9660-11t64",
            "binary_version": "2.1.0-4.1ubuntu1.2"
          },
          {
            "binary_name": "libudf0t64",
            "binary_version": "2.1.0-4.1ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libcdio",
        "purl": "pkg:deb/ubuntu/libcdio@2.1.0-4.1ubuntu1.2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.0-4.1ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.0-4",
        "2.1.0-4.1",
        "2.1.0-4.1ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.",
  "id": "UBUNTU-CVE-2024-36600",
  "modified": "2026-04-22T07:49:11Z",
  "published": "2024-06-14T19:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-36600"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36600"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600"
    },
    {
      "type": "REPORT",
      "url": "https://lists.gnu.org/archive/html/libcdio-devel/2024-04/msg00000.html"
    },
    {
      "type": "REPORT",
      "url": "https://lists.gnu.org/archive/html/libcdio-devel/2024-05/msg00005.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6855-1"
    }
  ],
  "related": [
    "USN-6855-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-36600"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-36600 (GCVE-0-2024-36600)

BDU:2024-04922 (CVE-2024-36600)

CNVD-2025-15360

FKIE_CVE-2024-36600

GHSA-89W5-XC64-FW9R

UBUNTU-CVE-2024-36600 (CVE-2024-36600)

Tags

Sightings

Nomenclature

Related by attack behaviour