Amazon Linux 2022 : libtiff, libtiff-devel, libtiff-static (ALAS2022-2022-094)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-094 advisory. A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a hea...

Amazon Linux 2022 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2022-2022-069)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-069 advisory. MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW. CVE-2021-46659 MariaDB through 10.5.9 allows an application cras...

Amazon Linux 2022 : openexr, openexr-devel, openexr-libs (ALAS2022-2022-061)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-061 advisory. An integer overflow could occur when OpenEXR processes a crafted file on systems where sizet is less than 64 bits. This issue could cause an invalid bytesPerLine and maxBytesPerLine value, whic...

Amazon Linux 2022 : httpd, httpd-core, httpd-devel (ALAS2022-2022-110)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-110 advisory. An HTTP request smuggling vulnerability was found in the modproxyajp module of httpd. This flaw allows an attacker to smuggle requests to the AJP server, where it forwards requests...

Amazon Linux 2022 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2022-2022-109)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-109 advisory. A flaw was found in grub 2, where a crafted 16-bit grayscale PNG image may lead to an out-of-bounds write. This flaw allows an attacker to corrupt the data on the heap portion of the grub2's...

Amazon Linux 2022 : fribidi, fribidi-devel (ALAS2022-2022-091)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-091 advisory. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory...

Amazon Linux 2022 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2022-2022-096)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-096 advisory. A use-after-free vulnerability was found in MariaDB. This flaw allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used, resulting in a denial of service...

Amazon Linux 2022 : mod_dav_svn, python3-subversion, subversion (ALAS2022-2022-076)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-076 advisory. A use-after-free vulnerability was found in Subversion in the moddavsvn Apache HTTP server HTTPd module. While looking up path-based authorization authz rules, multiple calls to the postconfig hook can...

Amazon Linux 2022 : kernel-livepatch-5.15.29-16.111 (ALAS2022-2022-101)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-101 advisory. A use-after-free flaw was found in the Linux kernel's iouring interface subsystem in the way a user triggers a race condition between timeout flush and removal. This flaw allows a local user to crash or...

Amazon Linux 2022 : bsdcat, bsdcpio, bsdtar (ALAS2022-2022-103)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-103 advisory. An out-of-bounds read flaw was found in libarchive. This flaw allows an attacker who can supply a specially crafted zip file to libarchive to cause an out-of-bounds read in programs linked with...

Amazon Linux 2022 : rubygem-nokogiri (ALAS2022-2022-062)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-062 advisory. Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this issue. CVE-2022-24836 Tenable has extracted the preceding description block directly...

Amazon Linux 2022 : logrotate (ALAS2022-2022-084)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-084 advisory. A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock...

Amazon Linux 2022 : zziplib, zziplib-devel, zziplib-utils (ALAS2022-2022-081)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-081 advisory. Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value zzipfileread in the function unzzipcatfile. CVE-2020-18442 Tenable has extracted the preceding...

Amazon Linux 2022 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2022-2022-048)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-048 advisory. A flaw was found in npm. The npm ci command proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the...

Amazon Linux 2022 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2022-2022-111)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-111 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : systemd, systemd-container, systemd-devel (ALAS2022-2022-052)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-052 advisory. A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. CVE-2021-3997 Tenable has...

Amazon Linux 2022 : microcode_ctl (ALAS2022-2022-129)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-129 advisory. A flaw was found in hw. The APIC can operate in xAPIC mode also known as a legacy mode, in which APIC configuration registers are exposed through a memory-mapped I/O MMIO page. This flaw allows...

Amazon Linux 2022 : gzip, xz, xz-devel (ALAS2022-2022-058)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-058 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's...

Amazon Linux 2022 : python3-twisted, python3-twisted+tls (ALAS2022-2022-046)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-046 advisory. An uncontrolled resource consumption flaw was found in python-twisted in the dataReceived function. This flaw allows an unauthenticated, remote attacker to send a simple command to use all available...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-127)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-127 advisory. A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. CVE-2022-2381...