Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-0500: A heap-based buffer overflow has been found in the Curl_smtp_escape_eob() function of curl. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory. 1597101: CVE-2018-0500 curl: Heap-based buffer overflow in Curl_smtp_escape_eob() when uploading data over SMTP
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | curl | 0:7.55.1-12.amzn2.0.5 |
| Amazon Linux · 2 | curl-debuginfo | 0:7.55.1-12.amzn2.0.5 |
| Amazon Linux · 2 | libcurl | 0:7.55.1-12.amzn2.0.5 |
| Amazon Linux · 2 | libcurl-devel | 0:7.55.1-12.amzn2.0.5 |
Vulnerabilities 1
-
Unscored —
Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mi…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-0500.html