Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-5278: A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | coreutils | 0:8.32-30.amzn2023.0.4 |
| Amazon Linux · 2023 | coreutils-common | 0:8.32-30.amzn2023.0.4 |
| Amazon Linux · 2023 | coreutils-debuginfo | 0:8.32-30.amzn2023.0.4 |
| Amazon Linux · 2023 | coreutils-debugsource | 0:8.32-30.amzn2023.0.4 |
| Amazon Linux · 2023 | coreutils-single | 0:8.32-30.amzn2023.0.4 |
| Amazon Linux · 2023 | coreutils-single-debuginfo | 0:8.32-30.amzn2023.0.4 |
Vulnerabilities 1
-
Medium 4.4
Coreutils: heap buffer under-read in gnu coreutils sort via key specification
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious inpu…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-5278.html