Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-5482: Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. 99999: CVE-2019-5482 curl: heap buffer overflow in function tftp_receive_packet() CVE-2019-5481: Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. 99999: CVE-2019-5481 curl: double free due to subsequent call of realloc()
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | curl | 0:7.61.1-12.amzn2.0.1 |
| Amazon Linux · 2 | curl-debuginfo | 0:7.61.1-12.amzn2.0.1 |
| Amazon Linux · 2 | libcurl | 0:7.61.1-12.amzn2.0.1 |
| Amazon Linux · 2 | libcurl-devel | 0:7.61.1-12.amzn2.0.1 |
Vulnerabilities 2
-
Critical 9.8
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
-
Critical 9.8CVE-2019-5482 EPSS 18%
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.