Skip to content
OpenAdvisories
High ALAS2-2023-1965 1 CVE

Important: libdb security update (Amazon Linux 2)

Published Mar 2, 2023 · Updated Mar 7, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-10140: Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 libdb 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-cxx 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-cxx-devel 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-debuginfo 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-devel 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-devel-doc 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-devel-static 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-java 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-java-devel 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-sql 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-sql-devel 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-tcl 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-tcl-devel 0:5.3.21-24.amzn2.0.4
Amazon Linux · 2 libdb-utils 0:5.3.21-24.amzn2.0.4

Vulnerabilities 1

  • Unscored —
    CVE-2017-10140

    Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain…

    db5.3 db5.3 Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-10140.html