Amazon Linux 2023 Security Advisory: ALAS2023-2026-1833
Advisory Released Date: 2026-06-22
Advisory Updated Date: 2026-06-22
Severity:
Important
Issue Overview:
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp. (CVE-2026-49014)
Affected Packages:
gdal310
Issue Correction:
Run dnf update gdal310 --releasever 2023.12.20260622 or dnf update --advisory ALAS2023-2026-1833 --releasever 2023.12.20260622 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
gdal310-devel-3.10.3-3.amzn2023.0.2.aarch64
gdal310-python-tools-3.10.3-3.amzn2023.0.2.aarch64
gdal310-java-3.10.3-3.amzn2023.0.2.aarch64
python3-gdal310-debuginfo-3.10.3-3.amzn2023.0.2.aarch64
gdal310-java-debuginfo-3.10.3-3.amzn2023.0.2.aarch64
gdal310-debuginfo-3.10.3-3.amzn2023.0.2.aarch64
gdal310-libs-debuginfo-3.10.3-3.amzn2023.0.2.aarch64
gdal310-3.10.3-3.amzn2023.0.2.aarch64
python3-gdal310-3.10.3-3.amzn2023.0.2.aarch64
gdal310-libs-3.10.3-3.amzn2023.0.2.aarch64
gdal310-debugsource-3.10.3-3.amzn2023.0.2.aarch64
noarch:
gdal310-javadoc-3.10.3-3.amzn2023.0.2.noarch
src:
gdal310-3.10.3-3.amzn2023.0.2.src
x86_64:
gdal310-libs-debuginfo-3.10.3-3.amzn2023.0.2.x86_64
python3-gdal310-debuginfo-3.10.3-3.amzn2023.0.2.x86_64
gdal310-3.10.3-3.amzn2023.0.2.x86_64
gdal310-java-debuginfo-3.10.3-3.amzn2023.0.2.x86_64
gdal310-java-3.10.3-3.amzn2023.0.2.x86_64
gdal310-python-tools-3.10.3-3.amzn2023.0.2.x86_64
gdal310-devel-3.10.3-3.amzn2023.0.2.x86_64
gdal310-libs-3.10.3-3.amzn2023.0.2.x86_64
gdal310-debuginfo-3.10.3-3.amzn2023.0.2.x86_64
python3-gdal310-3.10.3-3.amzn2023.0.2.x86_64
gdal310-debugsource-3.10.3-3.amzn2023.0.2.x86_64