Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-46604: The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset. CVE-2026-46602: The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption. CVE-2026-46601: The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | rclone | 0:1.74.3-82.amzn2023 |
| Amazon Linux · 2023 | rclone-debuginfo | 0:1.74.3-82.amzn2023 |
| Amazon Linux · 2023 | rclone-debugsource | 0:1.74.3-82.amzn2023 |
Vulnerabilities 3
-
High 7.5
Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
-
High 7.5
Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
-
High 7.5
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.