Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-29824: A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the xmlBuffer types. A substantial input causes values to calculate buffer sizes to overflow, resulting in an out-of-bounds write.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libxml2 | 0:2.9.1-6.amzn2.5.6 |
| Amazon Linux · 2 | libxml2-debuginfo | 0:2.9.1-6.amzn2.5.6 |
| Amazon Linux · 2 | libxml2-devel | 0:2.9.1-6.amzn2.5.6 |
| Amazon Linux · 2 | libxml2-python | 0:2.9.1-6.amzn2.5.6 |
| Amazon Linux · 2 | libxml2-static | 0:2.9.1-6.amzn2.5.6 |
Vulnerabilities 1
-
Unscored —
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-29824.html