Critical: clamav

Issue Overview: Possible remote code execution vulnerability in the ClamAV HFS+ file parser. The issue affects ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. CVE-2023-20032 A possible remote information leak vulnerability in the DMG file parser. The issue affects...

Medium: httpcomponents-client

Issue Overview: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. CVE-2020-13956 Affected Packages: httpcomponents-client...

Important: webkitgtk4

Issue Overview: A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2022-42823 Affected...

Medium: postgresql

Issue Overview: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and...

Important: libXpm

Issue Overview: A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. CVE-2022-44617 A flaw was found ...

Important: python-lxml

Issue Overview: Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function. CVE-2014-3146 An issue was discovered in lxml before 4.2.5...

Amazon Linux 2 : apr-util, apr-util-bdb, apr-util-devel (ALAS-2023-1937)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1937 advisory. Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable...

Amazon Linux 2 : apr, apr-devel (ALAS-2023-1936)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1936 advisory. An out-of-bounds array read in the aprtimeexp functions was fixed in the Apache Portable Runtime 1.6.3 release CVE-2017-12613. The fix for this issue was not carried forward to the APR 1.7.x...

Amazon Linux 2 : kernel, --advisory ALAS2-2023-1932 (ALAS-2023-1932)

The version of kernel installed on the remote host is prior to 4.14.304-226.531. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1932 advisory. Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interfa...

Amazon Linux 2 : openssl11 (ALAS-2023-1934)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1934 advisory. A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover ...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-013 (ALASKERNEL-5.15-2023-013)

The version of kernel installed on the remote host is prior to 5.15.90-54.138. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-013 advisory. In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows a...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-026 (ALASKERNEL-5.10-2023-026)

The version of kernel installed on the remote host is prior to 5.10.165-143.735. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-026 advisory. In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows...

Amazon Linux 2 : protobuf, protobuf-compiler, protobuf-devel (ALAS-2023-1931)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1931 advisory. A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute...

Amazon Linux 2 : sysstat (ALAS-2023-1925)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1925 advisory. sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocatestructures contains a sizet overflow in sacommon.c...

Amazon Linux 2 : git, git-all, git-core (ALAS-2023-1923)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1923 advisory. Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository...

Amazon Linux 2 : curl, libcurl, libcurl-devel (ALAS-2023-1924)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1924 advisory. A vulnerability was found in curl. This issue occurs due to an erroneous function. A malicious server could make curl within Network Security Services NSS get stuck in a never-ending busy loop wh...

Amazon Linux 2 : autotrace, autotrace-devel (ALAS-2023-1929)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1929 advisory. Heap-based buffer overflow in the pstoeditsuffixtableinit function in output-pstoedit.c in AutoTrace 0.31.1 allows remote attackers to cause a denial of service out-of-bounds write via a crafted...

Amazon Linux 2 : libudisks2, libudisks2-devel, udisks2 (ALAS-2023-1921)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1921 advisory. A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highest threat from this vulnerability is to system availability...

Amazon Linux 2 : libblkid, libblkid-devel, libfdisk (ALAS-2023-1920)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1920 advisory. DISPUTED An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the...

Amazon Linux 2 : emacs, emacs-common, emacs-devel (ALAS-2023-1928)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1928 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of...