Amazon Linux 2023 : xz, xz-devel, xz-libs (ALAS2023-2023-042)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-042 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's...

Amazon Linux 2023 : golist (ALAS2023-2023-046)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-046 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2023 : device-mapper-multipath, device-mapper-multipath-devel, device-mapper-multipath-libs (ALAS2023-2023-126)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-126 advisory. A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local user...

Medium: libsndfile

Issue Overview: An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file via tricking a user to open or otherwise to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read...

Amazon Linux 2023 : binutils, binutils-devel, binutils-gprofng (ALAS2023-2023-119)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-119 advisory. In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfdgetl32 when called from the stripmain function in strip-new via a crafted file. CVE-2022-38533 Tenable has extracted...

Amazon Linux 2023 : openexr, openexr-devel, openexr-libs (ALAS2023-2023-022)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-022 advisory. 2024-02-15: CVE-2021-20304 was added to this advisory. A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR...

Amazon Linux 2023 : python3-twisted, python3-twisted+tls (ALAS2023-2023-056)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-056 advisory. A flaw was found in the twisted Python library when WebClient redirects via the RedirectAgent and BrowserLikeRedirectAgent methods. This flaw allows an attacker to take advantage of these...

Amazon Linux 2023 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2023-2023-087)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-087 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-122)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-122 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its...

Amazon Linux 2023 : ldb-tools, libldb, libldb-devel (ALAS2023-2023-085)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-085 advisory. A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-059)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-059 advisory. 2024-02-15: CVE-2021-33037 was added to this advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request heade...

Amazon Linux 2023 : polkit, polkit-devel, polkit-libs (ALAS2023-2023-026)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-026 advisory. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-084)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-084 advisory. An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations a...

Low: ghostscript

Issue Overview: Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. CVE-2019-25059 Affected Packages: ghostscript Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-032)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-032 advisory. 2024-02-15: CVE-2016-2124 was added to this advisory. 2024-02-15: CVE-2021-44141 was added to this advisory. 2024-02-15: CVE-2021-20316 was added to this advisory. 2024-02-15: CVE-2020-17049 wa...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-128)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-128 advisory. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the...

Amazon Linux 2023 : libblkid, libblkid-devel, libfdisk (ALAS2023-2023-024)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-024 advisory. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to...

Amazon Linux 2023 : libksba, libksba-devel (ALAS2023-2023-088)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-088 advisory. A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing speciall...

Amazon Linux 2023 : sendmail, sendmail-cf, sendmail-milter (ALAS2023-2023-018)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-018 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-055)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-055 advisory. 2024-06-06: CVE-2021-33117 was added to this advisory. Improper access control for some 3rd Generation IntelR XeonR Scalable Processors before BIOS version MR7, may allow a local attacker to...