Skip to content
OpenAdvisories
Medium ALAS2-2023-2277 3 CVEs

Moderate: nasm security update (Amazon Linux 2)

Published Sep 27, 2023 · Updated Oct 5, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-46457: NASM v2.16 was discovered to contain a segmentation violation in the component ieee_write_file at /output/outieee.c. CVE-2020-21528: A Segmentation Fault issue discovered in in ieee_segment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a denial of service via crafted assembly file. CVE-2020-18780: A Use After Free vulnerability in function new_Token in asm/preproc.c in nasm 2.14.02 allows attackers to cause a denial of service via crafted nasm command.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 nasm 0:2.15.03-3.amzn2.0.3
Amazon Linux · 2 nasm-debuginfo 0:2.15.03-3.amzn2.0.3
Amazon Linux · 2 nasm-doc 0:2.15.03-3.amzn2.0.3
Amazon Linux · 2 nasm-rdoff 0:2.15.03-3.amzn2.0.3

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-18780.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-21528.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-46457.html