Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-35457: GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is "Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries()." The researcher states that this pattern is undocumented
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | glib2 | 0:2.56.1-9.amzn2.0.8 |
| Amazon Linux · 2 | glib2-debuginfo | 0:2.56.1-9.amzn2.0.8 |
| Amazon Linux · 2 | glib2-devel | 0:2.56.1-9.amzn2.0.8 |
| Amazon Linux · 2 | glib2-doc | 0:2.56.1-9.amzn2.0.8 |
| Amazon Linux · 2 | glib2-fam | 0:2.56.1-9.amzn2.0.8 |
| Amazon Linux · 2 | glib2-static | 0:2.56.1-9.amzn2.0.8 |
| Amazon Linux · 2 | glib2-tests | 0:2.56.1-9.amzn2.0.8 |
Vulnerabilities 1
-
Unscored —
GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entr…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-35457.html