Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31535: A missing validation flaw was found in libX11. This flaw allows an attacker to inject X11 protocol commands on X clients, and in some cases, also bypass, authenticate (via injection of control characters), or potentially execute arbitrary code with permissions of the application compiled with libX11. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1961822: CVE-2021-31535 libX11: missing request length checks
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libX11 | 0:1.6.7-3.amzn2.0.2 |
| Amazon Linux · 2 | libX11-common | 0:1.6.7-3.amzn2.0.2 |
| Amazon Linux · 2 | libX11-debuginfo | 0:1.6.7-3.amzn2.0.2 |
| Amazon Linux · 2 | libX11-devel | 0:1.6.7-3.amzn2.0.2 |
Vulnerabilities 1
-
Unscored —CVE-2021-31535 EPSS 10%
LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-31535.html