Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-7519: A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | polkit | 0:0.112-26.amzn2.2.1 |
| Amazon Linux · 2 | polkit-debuginfo | 0:0.112-26.amzn2.2.1 |
| Amazon Linux · 2 | polkit-devel | 0:0.112-26.amzn2.2.1 |
| Amazon Linux · 2 | polkit-docs | 0:0.112-26.amzn2.2.1 |
Vulnerabilities 1
-
Medium 6.7
Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write
A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-7519.html