Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-49014: In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | gdal310 | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | gdal310-debuginfo | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | gdal310-debugsource | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | gdal310-devel | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | gdal310-java | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | gdal310-java-debuginfo | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | gdal310-javadoc | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | gdal310-libs | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | gdal310-libs-debuginfo | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | gdal310-python-tools | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | python3-gdal310 | 0:3.10.3-3.amzn2023.0.2 |
| Amazon Linux · 2023 | python3-gdal310-debuginfo | 0:3.10.3-3.amzn2023.0.2 |
Vulnerabilities 1
-
High 7.4
GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-49014.html