Amazon Linux 1 Security Advisory: ALAS-2016-766
Advisory Release Date: 2016-11-10 18:00 Pacific
Advisory Updated Date: 2016-11-10 18:00 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
This build resolves the following issues:
CVE-2016-8615: Cookie injection for other servers
CVE-2016-8616: Case insensitive password comparison
CVE-2016-8617: Out-of-bounds write via unchecked multiplication
CVE-2016-8618: Double-free in curl_maprintf
CVE-2016-8619: Double-free in krb5 code
CVE-2016-8620: Glob parser write/read out of bounds
CVE-2016-8621: curl_getdate out-of-bounds read
CVE-2016-8622: URL unescape heap overflow via integer truncation
CVE-2016-8623: Use-after-free via shared cookies
CVE-2016-8624: Invalid URL parsing with '#'
Affected Packages:
curl
Issue Correction:
Run yum update curl to update your system.
i686:
libcurl-7.47.1-9.66.amzn1.i686
libcurl-devel-7.47.1-9.66.amzn1.i686
curl-7.47.1-9.66.amzn1.i686
curl-debuginfo-7.47.1-9.66.amzn1.i686
src:
curl-7.47.1-9.66.amzn1.src
x86_64:
curl-7.47.1-9.66.amzn1.x86_64
libcurl-devel-7.47.1-9.66.amzn1.x86_64
libcurl-7.47.1-9.66.amzn1.x86_64
curl-debuginfo-7.47.1-9.66.amzn1.x86_64