Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-42012: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format. CVE-2022-42011: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type. CVE-2022-42010: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | dbus | 1:1.10.24-7.amzn2.0.3 |
| Amazon Linux · 2 | dbus-debuginfo | 1:1.10.24-7.amzn2.0.3 |
| Amazon Linux · 2 | dbus-devel | 1:1.10.24-7.amzn2.0.3 |
| Amazon Linux · 2 | dbus-doc | 1:1.10.24-7.amzn2.0.3 |
| Amazon Linux · 2 | dbus-libs | 1:1.10.24-7.amzn2.0.3 |
| Amazon Linux · 2 | dbus-tests | 1:1.10.24-7.amzn2.0.3 |
| Amazon Linux · 2 | dbus-x11 | 1:1.10.24-7.amzn2.0.3 |
Vulnerabilities 3
-
Medium 6.5
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenti…
-
Medium 6.5
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenti…
-
Medium 6.5
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenti…