Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1183: A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | hsqldb | 1:1.8.1.3-15.amzn2.0.3 |
| Amazon Linux · 2 | hsqldb-demo | 1:1.8.1.3-15.amzn2.0.3 |
| Amazon Linux · 2 | hsqldb-javadoc | 1:1.8.1.3-15.amzn2.0.3 |
| Amazon Linux · 2 | hsqldb-manual | 1:1.8.1.3-15.amzn2.0.3 |
Vulnerabilities 1
-
Medium 5.0CVE-2023-1183 EPSS 65%
Arbitrary file write
A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1183.html