Skip to content
OpenAdvisories
Medium ALAS2023-2023-353 1 CVE

Moderate: gsl security update (Amazon Linux 2023)

Published Sep 14, 2023 · Updated Sep 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2020-35357: A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 gsl 0:2.6-4.amzn2023.0.4
Amazon Linux · 2023 gsl-debuginfo 0:2.6-4.amzn2023.0.4
Amazon Linux · 2023 gsl-debugsource 0:2.6-4.amzn2023.0.4
Amazon Linux · 2023 gsl-devel 0:2.6-4.amzn2023.0.4

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-35357.html