Important: nasm

2023-04-2718:37:00

alas.aws.amazon.com

nasm

buffer overflow

update

security advisory

amazon linux 2

red hat

mitre

vulnerability

unix

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

25.7%

JSON

Issue Overview:

NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856 (CVE-2022-44370)

Affected Packages:

nasm

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update nasm to update your system.

New Packages:

aarch64:  
    nasm-2.15.03-3.amzn2.0.2.aarch64  
    nasm-rdoff-2.15.03-3.amzn2.0.2.aarch64  
    nasm-debuginfo-2.15.03-3.amzn2.0.2.aarch64  
  
i686:  
    nasm-2.15.03-3.amzn2.0.2.i686  
    nasm-rdoff-2.15.03-3.amzn2.0.2.i686  
    nasm-debuginfo-2.15.03-3.amzn2.0.2.i686  
  
noarch:  
    nasm-doc-2.15.03-3.amzn2.0.2.noarch  
  
src:  
    nasm-2.15.03-3.amzn2.0.2.src  
  
x86_64:  
    nasm-2.15.03-3.amzn2.0.2.x86_64  
    nasm-rdoff-2.15.03-3.amzn2.0.2.x86_64  
    nasm-debuginfo-2.15.03-3.amzn2.0.2.x86_64

Additional References

Red Hat: CVE-2022-44370

Mitre: CVE-2022-44370

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64nasm< 2.15.03-3.amzn2.0.2nasm-2.15.03-3.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64nasm-rdoff< 2.15.03-3.amzn2.0.2nasm-rdoff-2.15.03-3.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64nasm-debuginfo< 2.15.03-3.amzn2.0.2nasm-debuginfo-2.15.03-3.amzn2.0.2.aarch64.rpm
Amazon Linux2i686nasm< 2.15.03-3.amzn2.0.2nasm-2.15.03-3.amzn2.0.2.i686.rpm
Amazon Linux2i686nasm-rdoff< 2.15.03-3.amzn2.0.2nasm-rdoff-2.15.03-3.amzn2.0.2.i686.rpm
Amazon Linux2i686nasm-debuginfo< 2.15.03-3.amzn2.0.2nasm-debuginfo-2.15.03-3.amzn2.0.2.i686.rpm
Amazon Linux2noarchnasm-doc< 2.15.03-3.amzn2.0.2nasm-doc-2.15.03-3.amzn2.0.2.noarch.rpm
Amazon Linux2x86_64nasm< 2.15.03-3.amzn2.0.2nasm-2.15.03-3.amzn2.0.2.x86_64.rpm
Amazon Linux2x86_64nasm-rdoff< 2.15.03-3.amzn2.0.2nasm-rdoff-2.15.03-3.amzn2.0.2.x86_64.rpm
Amazon Linux2x86_64nasm-debuginfo< 2.15.03-3.amzn2.0.2nasm-debuginfo-2.15.03-3.amzn2.0.2.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	aarch64	nasm	< 2.15.03-3.amzn2.0.2	nasm-2.15.03-3.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	nasm-rdoff	< 2.15.03-3.amzn2.0.2	nasm-rdoff-2.15.03-3.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	nasm-debuginfo	< 2.15.03-3.amzn2.0.2	nasm-debuginfo-2.15.03-3.amzn2.0.2.aarch64.rpm
Amazon Linux	2	i686	nasm	< 2.15.03-3.amzn2.0.2	nasm-2.15.03-3.amzn2.0.2.i686.rpm
Amazon Linux	2	i686	nasm-rdoff	< 2.15.03-3.amzn2.0.2	nasm-rdoff-2.15.03-3.amzn2.0.2.i686.rpm
Amazon Linux	2	i686	nasm-debuginfo	< 2.15.03-3.amzn2.0.2	nasm-debuginfo-2.15.03-3.amzn2.0.2.i686.rpm
Amazon Linux	2	noarch	nasm-doc	< 2.15.03-3.amzn2.0.2	nasm-doc-2.15.03-3.amzn2.0.2.noarch.rpm
Amazon Linux	2	x86_64	nasm	< 2.15.03-3.amzn2.0.2	nasm-2.15.03-3.amzn2.0.2.x86_64.rpm
Amazon Linux	2	x86_64	nasm-rdoff	< 2.15.03-3.amzn2.0.2	nasm-rdoff-2.15.03-3.amzn2.0.2.x86_64.rpm
Amazon Linux	2	x86_64	nasm-debuginfo	< 2.15.03-3.amzn2.0.2	nasm-debuginfo-2.15.03-3.amzn2.0.2.x86_64.rpm