Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-5674: A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system. CVE-2026-14330: Multiple unbounded alloca() calls in the PulseAudio protocol server. CVE-2026-14324: RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.
Fixed packages 27
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | pipewire | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-alsa | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-alsa-debuginfo | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-config-rates | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-config-upmix | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-debuginfo | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-debugsource | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-devel | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-doc | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-gstreamer | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-gstreamer-debuginfo | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-jack-audio-connection-kit | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-jack-audio-connection-kit-devel | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-jack-audio-connection-kit-libs | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-jack-audio-connection-kit-libs-debuginfo | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-libs | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-libs-debuginfo | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-module-x11 | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-module-x11-debuginfo | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-plugin-vulkan | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-plugin-vulkan-debuginfo | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-pulseaudio | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-pulseaudio-debuginfo | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-utils | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-utils-debuginfo | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-v4l2 | 0:1.2.7-4.amzn2023.0.5 |
| Amazon Linux · 2023 | pipewire-v4l2-debuginfo | 0:1.2.7-4.amzn2023.0.5 |
Vulnerabilities 3
-
High 8.8
Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading
A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed enviro…
-
Medium 6.5
Pipewire: raop rtsp null deref
RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.
-
Medium 5.5
Pipewire: pulse server alloca stack overflow
Multiple unbounded alloca() calls in the PulseAudio protocol server.