Amazon Linux 1 (EOL) Security Advisory: ALAS-2017-806
Advisory Released Date: 2017-03-22
Advisory Updated Date: 2017-03-22
Severity:
Low
Issue Overview:
libcurl's implementation of the printf() functions triggers a buffer overflow when doing a large floating point output. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. This flaw does not exist in the command line tool.
Affected Packages:
curl
Issue Correction:
Run yum update curl or yum update --advisory ALAS-2017-806 to update your system.
New Packages:
i686:
curl-7.47.1-9.70.amzn1.i686
libcurl-7.47.1-9.70.amzn1.i686
curl-debuginfo-7.47.1-9.70.amzn1.i686
libcurl-devel-7.47.1-9.70.amzn1.i686
src:
curl-7.47.1-9.70.amzn1.src
x86_64:
curl-debuginfo-7.47.1-9.70.amzn1.x86_64
libcurl-7.47.1-9.70.amzn1.x86_64
curl-7.47.1-9.70.amzn1.x86_64
libcurl-devel-7.47.1-9.70.amzn1.x86_64