CVE-2007-6613

CVE-2007-6613 is a medium-severity vulnerability in Gnu Libcdio with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 13% places it in the 96th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-119.

Key facts

• Severity: Medium (CVSS 2.0 base score 5.0)
• EPSS exploit prediction: 13% (96th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-119
• Affected product: Gnu Libcdio
• Published: 2008-01-03
• Last modified: 2026-06-16

Description

Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image that contains a long joilet file name.

Frequently asked questions

What is CVE-2007-6613?

Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image that contains a long joilet file name.

How severe is CVE-2007-6613?

CVE-2007-6613 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2007-6613 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 13% (96th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-6613?

CVE-2007-6613 affects Gnu Libcdio. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2007-6613?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2007-6613 published?

CVE-2007-6613 was published on 2008-01-03 and last updated on 2026-06-16.

References

• http://bugs.gentoo.org/show_bug.cgi?id=203777
• http://lists.gnu.org/archive/html/libcdio-devel/2007-12/msg00009.html
• http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
• http://secunia.com/advisories/28308
• http://secunia.com/advisories/28569
• http://secunia.com/advisories/28796
• http://secunia.com/advisories/28970
• http://secunia.com/advisories/29242
• http://security.gentoo.org/glsa/glsa-200801-08.xml
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:037
• http://www.securityfocus.com/bid/27131
• http://www.ubuntu.com/usn/usn-580-1
• http://www.vupen.com/english/advisories/2008/0030
• https://bugzilla.redhat.com/show_bug.cgi?id=427197
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39405

Affected products (1)

• cpe:2.3:a:gnu:libcdio:*:*:*:*:*:*:*:*

More vulnerabilities in Gnu Libcdio

• CVE-2017-18201 — Critical (CVSS 9.8): An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in…
• CVE-2017-18198 — High (CVSS 8.8): print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service…
• CVE-2024-36600 — High (CVSS 8.4): Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a…
• CVE-2017-18199 — Medium (CVSS 6.5): realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL…

All CVEs affecting Gnu Libcdio →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
• CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
• CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
• CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →