Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-91786: A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | gnome-shell | 0:47.3-706.amzn2023 |
| Amazon Linux · 2023 | gnome-shell-debuginfo | 0:47.3-706.amzn2023 |
| Amazon Linux · 2023 | gnome-shell-debugsource | 0:47.3-706.amzn2023 |
Vulnerabilities 1
-
Medium 6.1
Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit th…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-91786.html