ALAS-2016-705


Amazon Linux AMI Security Advisory: ALAS-2016-705
Advisory Release Date: 2016-06-03 19:28 Pacific
Severity: Medium
References: CVE-2015-8863 

Issue Overview:

A heap-based buffer overflow flaw was found in the tokenadd() function. By tricking a victim into processing a specially crafted JSON file, an attacker could use this flaw to crash jq or, potentially, execute arbitrary code on the victim's system. (CVE-2015-8863 )


Affected Packages:

jq


Issue Correction:
Run yum update jq to update your system.

New Packages:
i686:
    jq-libs-1.5-1.2.amzn1.i686
    jq-1.5-1.2.amzn1.i686
    jq-devel-1.5-1.2.amzn1.i686
    jq-debuginfo-1.5-1.2.amzn1.i686

src:
    jq-1.5-1.2.amzn1.src

x86_64:
    jq-1.5-1.2.amzn1.x86_64
    jq-devel-1.5-1.2.amzn1.x86_64
    jq-debuginfo-1.5-1.2.amzn1.x86_64
    jq-libs-1.5-1.2.amzn1.x86_64