Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7485: An argument order confusion flaw was found in the SQLWriteFileDSN API of unixODBC. This could only be exploited via a malicious ODBC database connector package with the maximum impact being a denial of service. 99999: CVE-2018-7485 unixODBC: Insecure buffer copy in SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c CVE-2018-7409: A buffer overflow flaw was found in the unicode_to_ansi_copy() function of unixODBC. This overflow is not directly controllable by an attacker making the maximum potential impact a crash or denial of service. 99999: CVE-2018-7409 unixODBC: Buffer overflow in unicode_to_ansi_copy() can lead to crash or other unspecified impact
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | unixODBC | 0:2.3.1-14.amzn2 |
| Amazon Linux · 2 | unixODBC-debuginfo | 0:2.3.1-14.amzn2 |
| Amazon Linux · 2 | unixODBC-devel | 0:2.3.1-14.amzn2 |
Vulnerabilities 2
-
Unscored —
In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
-
Unscored —
The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, …