Amazon Linux 2023 Security Advisory: ALAS2023-2026-3459
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
Severity:
Important
Issue Overview:
FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution. (CVE-2026-116723)
FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap. (CVE-2026-116724)
Affected Packages:
fltk
Issue Correction:
Run dnf update fltk --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3459 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
fltk-fluid-debuginfo-1.3.6-1.amzn2023.0.3.aarch64
fltk-static-1.3.6-1.amzn2023.0.3.aarch64
fltk-fluid-1.3.6-1.amzn2023.0.3.aarch64
fltk-debuginfo-1.3.6-1.amzn2023.0.3.aarch64
fltk-debugsource-1.3.6-1.amzn2023.0.3.aarch64
fltk-1.3.6-1.amzn2023.0.3.aarch64
fltk-devel-1.3.6-1.amzn2023.0.3.aarch64
src:
fltk-1.3.6-1.amzn2023.0.3.src
x86_64:
fltk-fluid-debuginfo-1.3.6-1.amzn2023.0.3.x86_64
fltk-static-1.3.6-1.amzn2023.0.3.x86_64
fltk-debuginfo-1.3.6-1.amzn2023.0.3.x86_64
fltk-1.3.6-1.amzn2023.0.3.x86_64
fltk-fluid-1.3.6-1.amzn2023.0.3.x86_64
fltk-debugsource-1.3.6-1.amzn2023.0.3.x86_64
fltk-devel-1.3.6-1.amzn2023.0.3.x86_64