Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9755: An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges. 1691624: CVE-2019-9755 ntfs-3g: heap-based buffer overflow leads to local root privilege escalation
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libguestfs-winsupport | 0:7.2-3.amzn2 |
Vulnerabilities 1
-
Unscored —
An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-9755.html