ALAS2023-2026-2029

References: CVE-2026-14324  CVE-2026-14330  CVE-2026-5674 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. (CVE-2026-14324)

Multiple unbounded alloca() calls in the PulseAudio protocol server. (CVE-2026-14330)

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system. (CVE-2026-5674)

Issue Correction:
Run dnf update pipewire --releasever 2023.12.20260803 or dnf update --advisory ALAS2023-2026-2029 --releasever 2023.12.20260803 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    pipewire-alsa-debuginfo-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-v4l2-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-config-rates-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-libs-debuginfo-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-alsa-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-debuginfo-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-devel-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-module-x11-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-gstreamer-debuginfo-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-config-upmix-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-pulseaudio-debuginfo-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-jack-audio-connection-kit-libs-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-jack-audio-connection-kit-devel-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-utils-debuginfo-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-plugin-vulkan-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-debugsource-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-doc-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-pulseaudio-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-jack-audio-connection-kit-libs-debuginfo-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-jack-audio-connection-kit-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-gstreamer-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-plugin-vulkan-debuginfo-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-module-x11-debuginfo-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-utils-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-v4l2-debuginfo-1.2.7-4.amzn2023.0.5.aarch64
    pipewire-libs-1.2.7-4.amzn2023.0.5.aarch64

src:
    pipewire-1.2.7-4.amzn2023.0.5.src

x86_64:
    pipewire-jack-audio-connection-kit-libs-debuginfo-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-pulseaudio-debuginfo-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-plugin-vulkan-debuginfo-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-v4l2-debuginfo-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-alsa-debuginfo-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-libs-debuginfo-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-utils-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-debugsource-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-module-x11-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-pulseaudio-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-devel-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-utils-debuginfo-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-v4l2-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-debuginfo-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-jack-audio-connection-kit-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-config-upmix-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-config-rates-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-gstreamer-debuginfo-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-module-x11-debuginfo-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-gstreamer-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-jack-audio-connection-kit-devel-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-plugin-vulkan-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-alsa-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-libs-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-jack-audio-connection-kit-libs-1.2.7-4.amzn2023.0.5.x86_64
    pipewire-doc-1.2.7-4.amzn2023.0.5.x86_64