Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-40897: Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | orc | 0:0.4.31-4.amzn2023.0.4 |
| Amazon Linux · 2023 | orc-compiler | 0:0.4.31-4.amzn2023.0.4 |
| Amazon Linux · 2023 | orc-compiler-debuginfo | 0:0.4.31-4.amzn2023.0.4 |
| Amazon Linux · 2023 | orc-debuginfo | 0:0.4.31-4.amzn2023.0.4 |
| Amazon Linux · 2023 | orc-debugsource | 0:0.4.31-4.amzn2023.0.4 |
| Amazon Linux · 2023 | orc-devel | 0:0.4.31-4.amzn2023.0.4 |
| Amazon Linux · 2023 | orc-doc | 0:0.4.31-4.amzn2023.0.4 |
Vulnerabilities 1
-
High 7.0
Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is trick…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40897.html