Amazon Linux 2023 : runc (ALAS2023-2024-710)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-710 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-708)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-708 advisory. Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to...

Medium: microcode_ctl

Issue Overview: Insufficient control flow management for some IntelR Xeon Processors may allow an authenticated user to potentially enable denial of service via local access. CVE-2024-22374 Affected Packages: microcodectl Issue Correction: Run dnf update microcodectl --releasever 2023.5.20240903 ...

Medium: docker

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 Affected Packages: docker Issue Correction: Run dnf update docker...

Medium: runc

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 Affected Packages: runc Issue Correction: Run dnf update runc --releasev...

Important: amazon-cloudwatch-agent

Issue Overview: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows...

Medium: tpm2-tss

Issue Overview: tpm2-tss: arbitrary quote data may go undetected by FapiVerifyQuote CVE-2024-29040 Affected Packages: tpm2-tss Issue Correction: Run dnf update tpm2-tss --releasever 2023.5.20240819 to update your system. New Packages: aarch64: tpm2-tss-fapi-4.0.2-1.amzn2023.aarch64 ...

Amazon Linux 2023 : p7zip, p7zip-plugins (ALAS2023-2024-705)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-705 advisory. The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 for 7zz contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buff...

Amazon Linux 2023 : iwl100-firmware, iwl105-firmware, iwl135-firmware (ALAS2023-2024-706)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-706 advisory. Improper validation in a model specific register MSR could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code...

Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2024-704)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-704 advisory. ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 ruby: Arbitrary memory address read vulnerability with Regex search CVE-2024-27282 Tenable has extracted the preceding descripti...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2024-702)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-702 advisory. Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pgdump, which is often a superuser. The attack...

Important: gtk3

Issue Overview: gtk3: gtk2: Library injection from CWD CVE-2024-6655 Affected Packages: gtk3 Issue Correction: Run dnf update gtk3 --releasever 2023.5.20240805 or dnf update --advisory ALAS2023-2024-675 --releasever 2023.5.20240805 to update your system. More information on how to update your...

Medium: mod_http2

Issue Overview: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Affected Packages: modhttp2 Issue Correction: Run dnf update modhttp2 --releasever 2023.5.202408...

Medium: tpm2-tools

Issue Overview: tpm2-tools: arbitrary quote data may go undetected by tpm2checkquote CVE-2024-29038 tpm2-tools: pcr selection value is not compared with the attest CVE-2024-29039 Affected Packages: tpm2-tools Issue Correction: Run dnf update tpm2-tools --releasever 2023.5.20240805 or dnf update...

Amazon Linux 2023 : mod_http2 (ALAS2023-2024-689)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-689 advisory. Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Tenable has...

Amazon Linux 2023 : nerdctl (ALAS2023-2024-700)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-700 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing...

Amazon Linux 2023 : libsndfile, libsndfile-devel, libsndfile-utils (ALAS2023-2024-701)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-701 advisory. Multiple signed integers overflow in function aureadheader in src/au.c and in functions mat4open and mat4readheader in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other...

Amazon Linux 2023 : squid (ALAS2023-2024-687)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-687 advisory. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This erro...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2024-692)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-692 advisory. Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfiapplyfilter function via a long PDF filter name. CVE-2024-29506 Artifex Ghostscript before 10.03.0 sometimes has ...

Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2024-688)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-688 advisory. krb5: GSS message token handling CVE-2024-37370 In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens...