Skip to content
OpenAdvisories
Medium ALAS2-2019-1354 2 CVEs

Moderate: unixODBC security update (Amazon Linux 2)

Published Nov 4, 2019 · Updated Nov 7, 2019

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7485: An argument order confusion flaw was found in the SQLWriteFileDSN API of unixODBC. This could only be exploited via a malicious ODBC database connector package with the maximum impact being a denial of service. 99999: CVE-2018-7485 unixODBC: Insecure buffer copy in SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c CVE-2018-7409: A buffer overflow flaw was found in the unicode_to_ansi_copy() function of unixODBC. This overflow is not directly controllable by an attacker making the maximum potential impact a crash or denial of service. 99999: CVE-2018-7409 unixODBC: Buffer overflow in unicode_to_ansi_copy() can lead to crash or other unspecified impact

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 unixODBC 0:2.3.1-14.amzn2
Amazon Linux · 2 unixODBC-debuginfo 0:2.3.1-14.amzn2
Amazon Linux · 2 unixODBC-devel 0:2.3.1-14.amzn2

Vulnerabilities 2

  • Unscored —

    In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.

  • Unscored —

    The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, …

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-7409.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-7485.html