Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-40897: Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | orc | 0:0.4.26-1.amzn2.0.3 |
| Amazon Linux · 2 | orc-compiler | 0:0.4.26-1.amzn2.0.3 |
| Amazon Linux · 2 | orc-debuginfo | 0:0.4.26-1.amzn2.0.3 |
| Amazon Linux · 2 | orc-devel | 0:0.4.26-1.amzn2.0.3 |
| Amazon Linux · 2 | orc-doc | 0:0.4.26-1.amzn2.0.3 |
Vulnerabilities 1
-
High 7.0
Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is trick…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40897.html