Skip to content
OpenAdvisories
Medium ALAS2-2019-1356 2 CVEs

Moderate: uriparser security update (Amazon Linux 2)

Published Nov 4, 2019 · Updated Nov 7, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19199: An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication. 99999: CVE-2018-19199 uriparser: Integer overflow via uriComposeQuery* or uriComposeQueryEx* function CVE-2018-19198: An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts. 99999: CVE-2018-19198 uriparser: Out-of-bounds write via uriComposeQuery* or uriComposeQueryEx* function

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 uriparser 0:0.7.5-10.amzn2
Amazon Linux · 2 uriparser-debuginfo 0:0.7.5-10.amzn2
Amazon Linux · 2 uriparser-devel 0:0.7.5-10.amzn2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19198.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19199.html