Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-24660: A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. CVE-2026-20884: An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | LibRaw | 0:0.19.4-1.amzn2.0.8 |
| Amazon Linux · 2 | LibRaw-debuginfo | 0:0.19.4-1.amzn2.0.8 |
| Amazon Linux · 2 | LibRaw-devel | 0:0.19.4-1.amzn2.0.8 |
| Amazon Linux · 2 | LibRaw-static | 0:0.19.4-1.amzn2.0.8 |
Vulnerabilities 2
-
High 8.1
An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A speciall…
-
High 8.1
A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A spe…