Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-89088: heap buffer overflow in duplicate_legacy_root_dir NOTE: https://alioth-lists.debian.net/pipermail/parted-devel/2026-September/006032.html CVE-2026-89085: heap buffer overflow in _init_fats / fat_table_read NOTE: https://alioth-lists.debian.net/pipermail/parted-devel/2026-September/006032.html
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | parted | 0:3.4-2.amzn2023.0.3 |
| Amazon Linux · 2023 | parted-debuginfo | 0:3.4-2.amzn2023.0.3 |
| Amazon Linux · 2023 | parted-debugsource | 0:3.4-2.amzn2023.0.3 |
| Amazon Linux · 2023 | parted-devel | 0:3.4-2.amzn2023.0.3 |
Vulnerabilities 2
-
Medium 6.6
Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image
A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service t…
-
Medium 5.5
Parted: parted: denial of service via heap buffer overflow during fat16 resize
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadat…