Amazon Linux 2023 Security Advisory: ALAS2023-2026-3432
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
Severity:
Medium
Issue Overview:
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory. (CVE-2026-91786)
Affected Packages:
gnome-shell
Issue Correction:
Run dnf update gnome-shell --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3432 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
gnome-shell-debuginfo-47.3-706.amzn2023.aarch64
gnome-shell-debugsource-47.3-706.amzn2023.aarch64
gnome-shell-47.3-706.amzn2023.aarch64
src:
gnome-shell-47.3-706.amzn2023.src
x86_64:
gnome-shell-debuginfo-47.3-706.amzn2023.x86_64
gnome-shell-debugsource-47.3-706.amzn2023.x86_64
gnome-shell-47.3-706.amzn2023.x86_64