Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-243)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-243 advisory. A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cau...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-235)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-235 advisory. A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data immediately befor...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-237)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-237 advisory. The use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the...

Amazon Linux 2023 : perl-HTTP-Daemon, perl-HTTP-Daemon-tests (ALAS2023-2023-247)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-247 advisory. HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2023-258)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-258 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle...

Amazon Linux 2023 : python3-setuptools, python3-setuptools-wheel (ALAS2023-2023-245)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-245 advisory. Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression...

Low: python-configobj

Issue Overview: All versions of the package configobj are vulnerable to Regular Expression Denial of Service ReDoS via the validate function, using .+?\.\. Note: This is only exploitable in the case of a developer, putting the offending value in a server side configuration file. CVE-2023-26112...

Low: open-vm-tools

Issue Overview: A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. CVE-2023-20867 Affected Packages: open-vm-tools Issue Correction: Run dnf update open-vm-tools...

Important: kernel-livepatch-6.1.29-47.49

Issue Overview: In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2022-48425 Affected Packages: kernel-livepatch-6.1.29-47.49 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-234)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-234 advisory. Reserved CVE CVE-2023-3269 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this issue but has instead relied...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-233)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-233 advisory. An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with certain traffic patterns. CVE-2023-1206 Tenable has extracted the preceding descriptio...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-228)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-228 advisory. In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF of alloc-vma in race with munmap CVE-2022-50240 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-215)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-215 advisory. OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service DoS attack. A buffer...

Amazon Linux 2023 : glib2, glib2-devel, glib2-static (ALAS2023-2023-225)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-225 advisory. The upstream bug report describes this issue as follows: A vulnerability was found in GLib2.0, where DoS caused by handling a malicious text-form variant which is structured to cause looping...

Amazon Linux 2023 : ncurses, ncurses-base, ncurses-c++-libs (ALAS2023-2023-220)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-220 advisory. ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security- relevant memory corruption via malformed data in a terminfo database file that is found in...

Amazon Linux 2023 : json-c, json-c-devel (ALAS2023-2023-232)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-232 advisory. A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to...

Amazon Linux 2023 : dbus, dbus-common, dbus-daemon (ALAS2023-2023-213)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-213 advisory. D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor...

Amazon Linux 2023 : libeconf, libeconf-devel, libeconf-utils (ALAS2023-2023-227)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-227 advisory. A Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in openSUSE libeconf leads to DoS via malformed config files.This issue affects libeconf: before 0.5.2...

Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-214)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-214 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : opensmtpd (ALAS2023-2023-221)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-221 advisory. asciiloadsockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable through 7.0.0-portable, can abort upon a connection from a local, scoped IPv6 address...