Skip to content
OpenAdvisories
Medium ALAS2-2019-1373 2 CVEs

Moderate: libidn2 security update (Amazon Linux 2)

Published Dec 13, 2019 · Updated Dec 18, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-18224: idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string. 1764780: CVE-2019-18224 libidn2: heap-based buffer overflow in idn2_to_ascii_4i in lib/lookup.c CVE-2019-12290: 99999:

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 idn2 0:2.3.0-1.amzn2
Amazon Linux · 2 libidn2 0:2.3.0-1.amzn2
Amazon Linux · 2 libidn2-debuginfo 0:2.3.0-1.amzn2
Amazon Linux · 2 libidn2-devel 0:2.3.0-1.amzn2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-12290.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-18224.html