Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5121: A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | bsdcpio | 0:3.1.2-14.amzn2.0.6 |
| Amazon Linux · 2 | bsdtar | 0:3.1.2-14.amzn2.0.6 |
| Amazon Linux · 2 | libarchive | 0:3.1.2-14.amzn2.0.6 |
| Amazon Linux · 2 | libarchive-debuginfo | 0:3.1.2-14.amzn2.0.6 |
| Amazon Linux · 2 | libarchive-devel | 0:3.1.2-14.amzn2.0.6 |
Vulnerabilities 1
-
High 7.5
Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing
A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overfl…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-5121.html