Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-5917: A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | bsdcpio | 0:3.1.2-14.amzn2.0.5 |
| Amazon Linux · 2 | bsdtar | 0:3.1.2-14.amzn2.0.5 |
| Amazon Linux · 2 | libarchive | 0:3.1.2-14.amzn2.0.5 |
| Amazon Linux · 2 | libarchive-debuginfo | 0:3.1.2-14.amzn2.0.5 |
| Amazon Linux · 2 | libarchive-devel | 0:3.1.2-14.amzn2.0.5 |
Vulnerabilities 1
-
Low 2.8
Libarchive: off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c
A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-5917.html