Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1122: If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function. 99999: CVE-2018-1122 procps-ng, procps: Local privilege escalation in top
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | procps-ng | 0:3.3.10-26.amzn2 |
| Amazon Linux · 2 | procps-ng-debuginfo | 0:3.3.10-26.amzn2 |
| Amazon Linux · 2 | procps-ng-devel | 0:3.3.10-26.amzn2 |
| Amazon Linux · 2 | procps-ng-i18n | 0:3.3.10-26.amzn2 |
Vulnerabilities 1
-
High 7.3CVE-2018-1122 Public exploit
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unse…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-1122.html