Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46045: buffer overflow via a crafted config6a file NOTE: Crosses no security boundary, config files are under local control NOTE: https://gitlab.com/graphviz/graphviz/-/issues/2441 NOTE: Introduced by: https://gitlab.com/graphviz/graphviz/-/commit/cf95714837f06f684929b54659523c2c9b1fc19f (2.38.0) NOTE: Fixed by: https://gitlab.com/graphviz/graphviz/-/commit/361f274ca901c3c476697a6404662d95f4dd43cb NOTE: Fixed by: https://gitlab.com/graphviz/graphviz/-/commit/3f31704cafd7da3e86bb2861accf5e90c973e62a NOTE: Fixed by: https://gitlab.com/graphviz/graphviz/-/commit/a95f977f5d809915ec4b14836d2b5b7f5e74881e
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | graphviz | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-debuginfo | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-debugsource | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-devel | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-doc | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-gd | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-gd-debuginfo | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-graphs | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-java | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-java-debuginfo | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-lua | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-lua-debuginfo | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-ocaml | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-ocaml-debuginfo | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-perl | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-perl-debuginfo | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-tcl | 0:2.44.0-25.amzn2023.0.7 |
| Amazon Linux · 2023 | graphviz-tcl-debuginfo | 0:2.44.0-25.amzn2023.0.7 |
Vulnerabilities 1
-
High 7.8
Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability m…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-46045.html