ALAS-2017-806


Amazon Linux AMI Security Advisory: ALAS-2017-806
Advisory Release Date: 2017-03-22 16:00 Pacific
Severity: Low
References: CVE-2016-9586 

Issue Overview:

libcurl's implementation of the printf() functions triggers a buffer overflow when doing a large floating point output. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. This flaw does not exist in the command line tool.


Affected Packages:

curl


Issue Correction:
Run yum update curl to update your system.

New Packages:
i686:
    curl-7.47.1-9.70.amzn1.i686
    libcurl-7.47.1-9.70.amzn1.i686
    curl-debuginfo-7.47.1-9.70.amzn1.i686
    libcurl-devel-7.47.1-9.70.amzn1.i686

src:
    curl-7.47.1-9.70.amzn1.src

x86_64:
    curl-debuginfo-7.47.1-9.70.amzn1.x86_64
    libcurl-7.47.1-9.70.amzn1.x86_64
    curl-7.47.1-9.70.amzn1.x86_64
    libcurl-devel-7.47.1-9.70.amzn1.x86_64