Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2023-079)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-079 advisory. A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary...

Amazon Linux 2023 : cpp, gcc, gcc-c++ (ALAS2023-2023-030)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-030 advisory. A flaw was found in the way Unicode standards are implemented in the context of development environments, which have specialized requirements for rendering text. An attacker could exploit this to deceiv...

Amazon Linux 2023 : libsndfile, libsndfile-devel, libsndfile-utils (ALAS2023-2023-028)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-028 advisory. An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file via tricking a user to open or otherwise to an application linke...

Amazon Linux 2023 : python3-lxml (ALAS2023-2023-034)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-034 advisory. There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using...

Amazon Linux 2023 : libinput, libinput-devel, libinput-test (ALAS2023-2023-041)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-041 advisory. A format string vulnerability was found in libinput CVE-2022-1215 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not teste...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2023-116)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-116 advisory. A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using inttext, a system could take 50ms to parse an int string with 100,000 digits and 5s f...

Amazon Linux 2023 : bcel, bcel-javadoc (ALAS2023-2023-105)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-105 advisory. Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitra...

Amazon Linux 2023 : less (ALAS2023-2023-123)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-123 advisory. 2024-02-29: CVE-2022-48624 was added to this advisory. In GNU Less before 609, crafted data can result in less -R not filtering ANSI escape sequences sent to the terminal. CVE-2022-46663...

Amazon Linux 2023 : ca-certificates (ALAS2023-2023-061)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-061 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from...

Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2023-112)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-112 advisory. Possible remote code execution vulnerability in the ClamAV HFS+ file parser. The issue affects ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. CVE-2023-20032 A...

Amazon Linux 2023 : python3-werkzeug (ALAS2023-2023-125)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-125 advisory. Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a smal...

Amazon Linux 2023 : python3-bottle (ALAS2023-2023-082)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-082 advisory. Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. CVE-2022-3179 Bottle before 0.12.20 mishandles errors during early request binding. CVE-2022-31799 Tenable has...

Amazon Linux 2023 : device-mapper-multipath, device-mapper-multipath-devel, device-mapper-multipath-libs (ALAS2023-2023-126)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-126 advisory. A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local user...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2023-020)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-020 advisory. A flaw was found in grub 2, where a crafted 16-bit grayscale PNG image may lead to an out-of-bounds write. This flaw allows an attacker to corrupt the data on the heap portion of the grub2's...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-055)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-055 advisory. 2024-06-06: CVE-2021-33117 was added to this advisory. Improper access control for some 3rd Generation IntelR XeonR Scalable Processors before BIOS version MR7, may allow a local attacker to...

Amazon Linux 2023 : aws-nitro-enclaves-cli, aws-nitro-enclaves-cli-devel, aws-nitro-enclaves-cli-integration-tests (ALAS2023-2023-129)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-129 advisory. Hyperium Hyper before 0.14.19 does not allow for customization of the maxheaderlistsize method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. CVE-2022-31394 Tenable has...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-108)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-108 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation o...

Amazon Linux 2023 : lz4, lz4-devel, lz4-libs (ALAS2023-2023-015)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-015 advisory. There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove on a negative size argument,...

Amazon Linux 2023 : sysstat (ALAS2023-2023-094)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-094 advisory. sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocatestructures contains a sizet overflow in...

Amazon Linux 2023 : cryptsetup, cryptsetup-devel, cryptsetup-libs (ALAS2023-2023-027)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-027 advisory. It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk...