Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-35357: A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | gsl | 0:1.15-13.amzn2.0.2 |
| Amazon Linux · 2 | gsl-debuginfo | 0:1.15-13.amzn2.0.2 |
| Amazon Linux · 2 | gsl-devel | 0:1.15-13.amzn2.0.2 |
Vulnerabilities 1
-
Unscored —
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Lib…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-35357.html