Skip to content
OpenAdvisories
Medium ALAS2-2023-2107 2 CVEs

Moderate: glib2 security update (Amazon Linux 2)

Published Jun 21, 2023 · Updated Jun 29, 2023

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-8394: PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8390: PCRE before 8.38 mishandles the [: and \ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 glib2 0:2.56.1-9.amzn2.0.6
Amazon Linux · 2 glib2-debuginfo 0:2.56.1-9.amzn2.0.6
Amazon Linux · 2 glib2-devel 0:2.56.1-9.amzn2.0.6
Amazon Linux · 2 glib2-doc 0:2.56.1-9.amzn2.0.6
Amazon Linux · 2 glib2-fam 0:2.56.1-9.amzn2.0.6
Amazon Linux · 2 glib2-static 0:2.56.1-9.amzn2.0.6
Amazon Linux · 2 glib2-tests 0:2.56.1-9.amzn2.0.6

Vulnerabilities 2

  • Unscored —

    PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a den…

  • Unscored —

    PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a den…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2015-8390.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2015-8394.html