Skip to content
OpenAdvisories
Medium ALAS2023-2025-1042 1 CVE

Moderate: abseil-cpp security update (Amazon Linux 2023)

Published Jun 18, 2025 · Updated Jun 23, 2025

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-0838: There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 abseil-cpp 0:20220623.1-4.amzn2023.0.2
Amazon Linux · 2023 abseil-cpp-debuginfo 0:20220623.1-4.amzn2023.0.2
Amazon Linux · 2023 abseil-cpp-debugsource 0:20220623.1-4.amzn2023.0.2
Amazon Linux · 2023 abseil-cpp-devel 0:20220623.1-4.amzn2023.0.2

Vulnerabilities 1

  • Medium 5.9

    Heap Buffer overflow in Abseil

    There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a v…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-0838.html