Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-122)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-122 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2023-078)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-078 advisory. NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by targeting an Unbound instance. Unbound is queri...

Amazon Linux 2023 : libinput, libinput-devel, libinput-test (ALAS2023-2023-041)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-041 advisory. A format string vulnerability was found in libinput CVE-2022-1215 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not teste...

Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2023-052)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-052 advisory. A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause...

Amazon Linux 2023 : python3-lxml (ALAS2023-2023-034)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-034 advisory. There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-101)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-101 advisory. A flaw was found in Open SSL. A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-051)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-051 advisory. The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2023-058)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-058 advisory. In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc misbehavior e.g., allocating too few bytes, or only freeing...

Amazon Linux 2023 : libblkid, libblkid-devel, libfdisk (ALAS2023-2023-024)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-024 advisory. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-120)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-120 advisory. Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file CVE-2022-4344 Infinite loo...

Amazon Linux 2023 : libsolv, libsolv-demo, libsolv-devel (ALAS2023-2023-013)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-013 advisory. A flaw was found in libsolv. A buffer overflow vulnerability could cause a denial of service. The highest threat from this vulnerability is to system availability. CVE-2021-3200 Tenable has extracted th...

Amazon Linux 2023 : openexr, openexr-devel, openexr-libs (ALAS2023-2023-022)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-022 advisory. 2024-02-15: CVE-2021-20304 was added to this advisory. A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR...

Amazon Linux 2023 : polkit, polkit-devel, polkit-libs (ALAS2023-2023-026)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-026 advisory. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users...

Amazon Linux 2023 : flac, flac-devel, flac-libs (ALAS2023-2023-008)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-008 advisory. An out-of-bounds write vulnerability was found in libFlak. The vulnerability occurs due to a missing bounds check. This flaw allows a local attacker without additional execution privileges to cause loca...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-055)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-055 advisory. 2024-06-06: CVE-2021-33117 was added to this advisory. Improper access control for some 3rd Generation IntelR XeonR Scalable Processors before BIOS version MR7, may allow a local attacker to...

Amazon Linux 2023 : aws-nitro-enclaves-cli, aws-nitro-enclaves-cli-devel, aws-nitro-enclaves-cli-integration-tests (ALAS2023-2023-129)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-129 advisory. Hyperium Hyper before 0.14.19 does not allow for customization of the maxheaderlistsize method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. CVE-2022-31394 Tenable has...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-108)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-108 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation o...

Amazon Linux 2023 : lz4, lz4-devel, lz4-libs (ALAS2023-2023-015)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-015 advisory. There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove on a negative size argument,...

Amazon Linux 2023 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2023-2023-068)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-068 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This...

Amazon Linux 2023 : python3-bottle (ALAS2023-2023-082)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-082 advisory. Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. CVE-2022-3179 Bottle before 0.12.20 mishandles errors during early request binding. CVE-2022-31799 Tenable has...