Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29491: ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ncurses | 0:6.0-8.20170212.amzn2.1.5 |
| Amazon Linux · 2 | ncurses-base | 0:6.0-8.20170212.amzn2.1.5 |
| Amazon Linux · 2 | ncurses-c++-libs | 0:6.0-8.20170212.amzn2.1.5 |
| Amazon Linux · 2 | ncurses-compat-libs | 0:6.0-8.20170212.amzn2.1.5 |
| Amazon Linux · 2 | ncurses-debuginfo | 0:6.0-8.20170212.amzn2.1.5 |
| Amazon Linux · 2 | ncurses-devel | 0:6.0-8.20170212.amzn2.1.5 |
| Amazon Linux · 2 | ncurses-libs | 0:6.0-8.20170212.amzn2.1.5 |
| Amazon Linux · 2 | ncurses-static | 0:6.0-8.20170212.amzn2.1.5 |
| Amazon Linux · 2 | ncurses-term | 0:6.0-8.20170212.amzn2.1.5 |
Vulnerabilities 1
-
Unscored —
ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-29491.html