Skip to content
OpenAdvisories
High ALAS2023-2023-227 2 CVEs

Important: libeconf security update (Amazon Linux 2023)

Published Jun 21, 2023 · Updated Jun 27, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32181: A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2. CVE-2023-22652: A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2023 libeconf 0:0.4.0-1.amzn2023.0.3
Amazon Linux · 2023 libeconf-debuginfo 0:0.4.0-1.amzn2023.0.3
Amazon Linux · 2023 libeconf-debugsource 0:0.4.0-1.amzn2023.0.3
Amazon Linux · 2023 libeconf-devel 0:0.4.0-1.amzn2023.0.3
Amazon Linux · 2023 libeconf-utils 0:0.4.0-1.amzn2023.0.3
Amazon Linux · 2023 libeconf-utils-debuginfo 0:0.4.0-1.amzn2023.0.3

Vulnerabilities 2

  • Low 3.3
    CVE-2023-22652

    Stack buffer overflow in "read_file" function

    A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2.

    openSUSE libeconf libeconf libeconf Debian Ubuntu
  • Low 3.3
    CVE-2023-32181

    Stack buffer overflow in "econf_writeFile" function

    A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2.

    openSUSE libeconf libeconf libeconf Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-22652.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-32181.html