Amazon Linux 1 Security Advisory: ALAS-2017-850
Advisory Release Date: 2017-06-22 19:24 Pacific
Advisory Updated Date: 2017-06-22 23:03 Pacific
The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a certain character, which leads to a heap-based buffer over-read.(CVE-2017-7407 )
Affected Packages:
curl
Issue Correction:
Run yum update curl to update your system.
i686:
curl-debuginfo-7.51.0-6.74.amzn1.i686
libcurl-devel-7.51.0-6.74.amzn1.i686
libcurl-7.51.0-6.74.amzn1.i686
curl-7.51.0-6.74.amzn1.i686
src:
curl-7.51.0-6.74.amzn1.src
x86_64:
libcurl-7.51.0-6.74.amzn1.x86_64
curl-7.51.0-6.74.amzn1.x86_64
curl-debuginfo-7.51.0-6.74.amzn1.x86_64
libcurl-devel-7.51.0-6.74.amzn1.x86_64