Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-4156: An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libsndfile | 0:1.0.25-12.amzn2.2 |
| Amazon Linux · 2 | libsndfile-debuginfo | 0:1.0.25-12.amzn2.2 |
| Amazon Linux · 2 | libsndfile-devel | 0:1.0.25-12.amzn2.2 |
| Amazon Linux · 2 | libsndfile-utils | 0:1.0.25-12.amzn2.2 |
Vulnerabilities 1
-
Unscored —
An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a spec…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-4156.html