Skip to content
OpenAdvisories
Medium ALAS2023-2023-080 2 CVEs

Moderate: dbus-broker security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-31213: An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file. CVE-2022-31212: An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line. c-shquote contains a stack-based buffer over-read if a malicious Exec line is supplied.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 dbus-broker 0:32-1.amzn2023.0.2
Amazon Linux · 2023 dbus-broker-debuginfo 0:32-1.amzn2023.0.2
Amazon Linux · 2023 dbus-broker-debugsource 0:32-1.amzn2023.0.2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31212.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31213.html