Skip to content
OpenAdvisories
High ALAS2-2018-1060 1 CVE

Important: openslp security update (Amazon Linux 2)

Published Aug 21, 2018 · Updated Aug 21, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-17833: A use-after-free flaw in OpenSLP 1.x and 2.x baselines was discovered in the ProcessSrvRqst function. A failure to update a local pointer may lead to heap corruption. A remote attacker may be able to leverage this flaw to gain remote code execution. 1572166: CVE-2017-17833 openslp: Heap memory corruption in slpd/slpd_process.c allows denial of service or potentially code execution

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 openslp 1:2.0.0-7.amzn2
Amazon Linux · 2 openslp-debuginfo 1:2.0.0-7.amzn2
Amazon Linux · 2 openslp-devel 1:2.0.0-7.amzn2
Amazon Linux · 2 openslp-server 1:2.0.0-7.amzn2

Vulnerabilities 1

  • Unscored —
    CVE-2017-17833

    OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest its…

    openslp-dfsg Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-17833.html