Medium: giflib

Issue Overview: An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read. CVE-2020-23922 There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB in gif2rgb.c:298:45. CVE-2022-28506 Affected Packages: giflib Issue Correction: Ru...

Medium: bash

Issue Overview: A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parametertransform. This issue may lead to memory problems. CVE-2022-3715 Affected Packages: bash Issue Correction: Run dnf update bash --releasever 2023.0.20230322 or dnf update --advisory...

Important: golang

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: golang Issue Correction: Run dnf update golang --releasever 2023.0.20230322 or dnf update --advisory ALAS2023-2023-142 --releasever 2023.0.20230322 to update your system. More information o...

Medium: sudo

Issue Overview: Sudo before 1.9.13 does not escape control characters in log messages. CVE-2023-28486 Sudo before 1.9.13 does not escape control characters in sudoreplay output. CVE-2023-28487 Affected Packages: sudo Issue Correction: Run dnf update sudo --releasever 2023.0.20230322 or dnf update...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-048)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-048 advisory. A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files. CVE-2021-33196 A...

Amazon Linux 2023 : cyrus-sasl, cyrus-sasl-devel, cyrus-sasl-gs2 (ALAS2023-2023-063)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-063 advisory. A flaw was found in the SQL plugin shipped with Cyrus SASL. Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands. This issue can lead to the escalation of...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-038)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-038 advisory. A NULL pointer exception flaw was found in Wireshark. A process failure on crafted or malformed input in the IPPUSB dissector can cause a denial of service via a packet injection or a crafted...

Amazon Linux 2023 : harfbuzz, harfbuzz-devel, harfbuzz-icu (ALAS2023-2023-111)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-111 advisory. An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service DoS via unspecified vectors. CVE-2022-33068 hb-ot-layout-gsubgpos.h...

Amazon Linux 2023 : cpio (ALAS2023-2023-021)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-021 advisory. GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is...

Amazon Linux 2023 : openjpeg2, openjpeg2-devel, openjpeg2-tools (ALAS2023-2023-040)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-040 advisory. There is a flaw in the opj2compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2compress, could trigger a heap...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-101)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-101 advisory. A flaw was found in Open SSL. A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2023-058)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-058 advisory. In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc misbehavior e.g., allocating too few bytes, or only freeing...

Amazon Linux 2023 : cpp, gcc, gcc-c++ (ALAS2023-2023-030)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-030 advisory. A flaw was found in the way Unicode standards are implemented in the context of development environments, which have specialized requirements for rendering text. An attacker could exploit this to deceiv...

Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2023-052)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-052 advisory. A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause...

Amazon Linux 2023 : tpm2-tss, tpm2-tss-devel (ALAS2023-2023-110)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-110 advisory. tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Stack TSS2. In affected versions Tss2RCSetHandler and Tss2RCDecode both index...

Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2023-081)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-081 advisory. A vulnerability was found in php. This issue occurs due to memory corruption in the finfobuffer function and a bad patch of the libmagic library. This flaw allows an attacker or malicious actor...

Amazon Linux 2023 : bash, bash-devel (ALAS2023-2023-091)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-091 advisory. A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parametertransform. This issue may lead to memory problems. CVE-2022-3715 Tenable has extracted the preceding...

Amazon Linux 2023 : python3-subversion, subversion, subversion-devel (ALAS2023-2023-011)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-011 advisory. A flaw was found in Subversion. When using path-based authorization authz, the helper function detectchanged does not omit potentially sensitive information from log messages. In particular, if...

Amazon Linux 2023 : python3-certifi (ALAS2023-2023-062)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-062 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from...

Amazon Linux 2023 : minizip-compat, minizip-compat-devel, zlib (ALAS2023-2023-003)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-003 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large numbe...