Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42798: Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c. CVE-2026-41254: Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | lcms2 | 0:2.19-75.amzn2023.0.1 |
| Amazon Linux · 2023 | lcms2-debuginfo | 0:2.19-75.amzn2023.0.1 |
| Amazon Linux · 2023 | lcms2-debugsource | 0:2.19-75.amzn2023.0.1 |
| Amazon Linux · 2023 | lcms2-devel | 0:2.19-75.amzn2023.0.1 |
| Amazon Linux · 2023 | lcms2-utils | 0:2.19-75.amzn2023.0.1 |
| Amazon Linux · 2023 | lcms2-utils-debuginfo | 0:2.19-75.amzn2023.0.1 |
Vulnerabilities 2
-
Medium 4.0
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed…
-
Medium 4.0
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.