ALAS-2017-850


Amazon Linux AMI Security Advisory: ALAS-2017-850
Advisory Release Date: 2017-06-22 23:03 Pacific
Severity: Low
References: CVE-2017-7407 

Issue Overview:

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a certain character, which leads to a heap-based buffer over-read.(CVE-2017-7407 )


Affected Packages:

curl


Issue Correction:
Run yum update curl to update your system.

New Packages:
i686:
    curl-debuginfo-7.51.0-6.74.amzn1.i686
    libcurl-devel-7.51.0-6.74.amzn1.i686
    libcurl-7.51.0-6.74.amzn1.i686
    curl-7.51.0-6.74.amzn1.i686

src:
    curl-7.51.0-6.74.amzn1.src

x86_64:
    libcurl-7.51.0-6.74.amzn1.x86_64
    curl-7.51.0-6.74.amzn1.x86_64
    curl-debuginfo-7.51.0-6.74.amzn1.x86_64
    libcurl-devel-7.51.0-6.74.amzn1.x86_64