Important: kernel-livepatch-5.10.165-143.735

Issue Overview: The upstream bug report describes this issue as follows: A flaw found in the Linux Kernel in RDS Reliable Datagram Sockets protocol. The rdsrmzerocopycallback uses listentry on the head of a list causing a type confusion. Local user can trigger this with rdsmessageput. Type...

Amazon Linux 2 : vim (ALAS-2023-2005)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2005 advisory. A heap-based buffer overflow vulnerability was found in GitHub repository vim/vim prior to 9.0.1376 in Vim's utfptr2char function of the src/mbyte.c file. This flaw occurs because there is access...

Amazon Linux 2 : systemd (ALAS-2023-2004)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2004 advisory. systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files ...

Amazon Linux 2 : xstream (ALAS-2023-2007)

The version of xstream installed on the remote host is prior to 1.3.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2007 advisory. XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the...

Amazon Linux 2 : dbus (ALAS-2023-2006)

The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2006 advisory. An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticate...

Amazon Linux 2 : booth (ALAS-2023-2009)

The version of booth installed on the remote host is prior to 1.0-8.ef769ef.git. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2009 advisory. The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to...

Amazon Linux 2 : python-twisted-web (ALAS-2023-2008)

The version of python-twisted-web installed on the remote host is prior to 12.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2008 advisory. Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does no...

Medium: gstreamer-plugins-good

Issue Overview: GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files. CVE-2021-3497 Affected Packages: gstreamer-plugins-good Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for...

Medium: babel

Issue Overview: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files containing serialized Python objects via directory traversal, leading to code execution. CVE-2021-42771 Affected Packages: babel Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Medium: vim

Issue Overview: A heap-based buffer overflow vulnerability was found in GitHub repository vim/vim prior to 9.0.1376 in Vim's utfptr2char function of the src/mbyte.c file. This flaw occurs because there is access to invalid memory with put in visual block mode. An attacker can trick a user into...

Medium: booth

Issue Overview: The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster. CVE-2022-2553...

Amazon Linux 2 : kernel, --advisory ALAS2-2023-1987 (ALAS-2023-1987)

The version of kernel installed on the remote host is prior to 4.14.309-231.529. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1987 advisory. In the Linux kernel, the following vulnerability has been resolved: net: sched: fix memory leak in tcindexsetparms...

Amazon Linux 2 : xdg-utils (ALAS-2023-2002)

The version of xdg-utils installed on the remote host is prior to 1.1.0-0.17.20120809git. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2002 advisory. A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs,...

Amazon Linux 2 : audiofile (ALAS-2023-1997)

The version of audiofile installed on the remote host is prior to 0.3.6-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1997 advisory. In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows ...

Amazon Linux 2 : libxml2 (ALAS-2023-1996)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1996 advisory. An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser...

Amazon Linux 2 : vim (ALAS-2023-1991)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1991 advisory. Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. CVE-2023-1127 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-028 (ALASKERNEL-5.10-2023-028)

The version of kernel installed on the remote host is prior to 5.10.173-154.642. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-028 advisory. A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks...

Amazon Linux 2 : nss (ALAS-2023-1992)

The version of nss installed on the remote host is prior to 3.79.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1992 advisory. firefox-esr , thunderbird and nss only are affected by this package. CVE-2023-0767 Tenable has extracted the preceding description blo...

Amazon Linux 2 : python3 (ALAS-2023-1990)

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1990 advisory. An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL...

Amazon Linux 2 : ghostscript (ALAS-2023-2003)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2003 advisory. Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-383...