Amazon Linux 2 : golang (ALAS-2022-1887)

The version of golang installed on the remote host is prior to 1.18.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1887 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to...

Amazon Linux 2 : libtiff (ALAS-2022-1891)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1891 advisory. A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main function. This flaw allows an attacker to pass a...

Amazon Linux 2 : 389-ds-base (ALAS-2022-1879)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1879 advisory. A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL...

Amazon Linux 2 : libbpf (ALAS-2022-1889)

The version of libbpf installed on the remote host is prior to 0.5.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1889 advisory. A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btfdumpnamedups of the file...

Amazon Linux 2 : bluez (ALAS-2022-1881)

The version of bluez installed on the remote host is prior to 5.44-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1881 advisory. 2023-06-07: CVE-2022-39177 was added to this advisory. A vulnerability was found in BlueZ. This flaw allows physically...

Amazon Linux 2 : mutt (ALAS-2022-1892)

The version of mutt installed on the remote host is prior to 1.5.21-29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1892 advisory. Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. CVE-2020-14093 Mutt before...

Amazon Linux AMI : golang (ALAS-2022-1635)

The version of golang installed on the remote host is prior to 1.18.6-1.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1635 advisory. 2023-11-29: CVE-2021-39293 was added to this advisory. 2023-11-29: CVE-2022-23806 was added to this advisory. 2023-11-29...

Amazon Linux 2 : ncurses (ALAS-2022-1893)

The version of ncurses installed on the remote host is prior to 6.0-8.20170212. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1893 advisory. The ncurses package tic is susceptible to a heap overflow on crafted input. When the terminfo entry- description...

Amazon Linux 2 : e2fsprogs (ALAS-2022-1884)

The version of e2fsprogs installed on the remote host is prior to 1.42.9-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1884 advisory. An out-of-bounds read/write vulnerability was found in e2fsprogs. This issue leads to a segmentation fault and possibly arbitra...

Amazon Linux 2 : pcs (ALAS-2022-1895)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1895 advisory. A denial of service flaw was found in ruby-rack. An attacker crafting multipart POST requests can cause Rack's multipart...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-008)

The version of kernel installed on the remote host is prior to 5.10.82-83.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-008 advisory. A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose handler could...

Amazon Linux 2 : git (ALAS-2022-1886)

The version of git installed on the remote host is prior to 2.38.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1886 advisory. Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34....

Medium: 389-ds-base

Issue Overview: A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. CVE-2022-2850 Affected Packages...

Important: libksba

Issue Overview: A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment...

Medium: ncurses

Issue Overview: The ncurses package tic is susceptible to a heap overflow on crafted input. When the terminfo entry-description compiler processes input, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is system availability...

Important: expat

Issue Overview: In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. CVE-2022-43680 Affected Packages: expat Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...

Important: golang

Issue Overview: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...

Medium: util-linux

Issue Overview: A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error...

Medium: systemd

Issue Overview: An off-by-one Error issue was discovered in Systemd in formattimespan function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in formattimespan, leading to a Denial of Service. CVE-2022-3821 Affected Packages: systemd...

Low: openjpeg2

Issue Overview: A flaw was found in the opj2decompress program in openjpeg2 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free on an uninitialized pointer, leading to a segmentation...