Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-7519: A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | polkit | 0:125-1.amzn2023.0.2 |
| Amazon Linux · 2023 | polkit-debuginfo | 0:125-1.amzn2023.0.2 |
| Amazon Linux · 2023 | polkit-debugsource | 0:125-1.amzn2023.0.2 |
| Amazon Linux · 2023 | polkit-devel | 0:125-1.amzn2023.0.2 |
| Amazon Linux · 2023 | polkit-docs | 0:125-1.amzn2023.0.2 |
| Amazon Linux · 2023 | polkit-libs | 0:125-1.amzn2023.0.2 |
| Amazon Linux · 2023 | polkit-libs-debuginfo | 0:125-1.amzn2023.0.2 |
Vulnerabilities 1
-
Medium 6.7
Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write
A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-7519.html