Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-29070: A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because "this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation."
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | lcms2 | 0:2.16-74.amzn2023 |
| Amazon Linux · 2023 | lcms2-debuginfo | 0:2.16-74.amzn2023 |
| Amazon Linux · 2023 | lcms2-debugsource | 0:2.16-74.amzn2023 |
| Amazon Linux · 2023 | lcms2-devel | 0:2.16-74.amzn2023 |
| Amazon Linux · 2023 | lcms2-utils | 0:2.16-74.amzn2023 |
| Amazon Linux · 2023 | lcms2-utils-debuginfo | 0:2.16-74.amzn2023 |
Vulnerabilities 1
-
High 7.5
A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a rem…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-29070.html