Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-78322: A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | file-roller | 0:3.28.1-2.amzn2.0.1 |
| Amazon Linux · 2 | file-roller-debuginfo | 0:3.28.1-2.amzn2.0.1 |
| Amazon Linux · 2 | file-roller-nautilus | 0:3.28.1-2.amzn2.0.1 |
Vulnerabilities 1
-
Medium 6.5
File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy.…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-78322.html