Amazon Linux 2 : krb5 (ALAS-2024-2512)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2512 advisory. Kerberos 5 aka krb5 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmaprmt.c. CVE-2024-26458 Kerberos 5 aka krb5 1.21.2 contains a memory leak vulnerability in...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2024-583)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-583 advisory. A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents function. This issue occurs when byte-swapped length values are used in replies, potentially...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-585)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-585 advisory. 2024-07-03: CVE-2024-26643 was added to this advisory. 2024-07-03: CVE-2024-26642 was added to this advisory. 2024-07-03: CVE-2024-36031 was added to this advisory. 2024-06-06: CVE-2024-35801 w...

Amazon Linux 2023 : libreswan (ALAS2023-2024-587)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-587 advisory. The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys authby=secret and the connection...

Amazon Linux AMI : tigervnc (ALAS-2024-1927)

The version of tigervnc installed on the remote host is prior to 1.8.0-21.36. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1927 advisory. The ProcRenderAddGlyphs function calls the AllocateGlyph function to store new glyphs sent by the client to the X server...

Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2024-586)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-586 advisory. Kerberos 5 aka krb5 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmaprmt.c. CVE-2024-26458 Kerberos 5 aka krb5 1.21.2 contains a memory leak vulnerability in...

Medium: python3.11

Issue Overview: An issue was found in the CPython zipfile module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to "quoted-overlap" zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed...

Amazon Linux AMI : glib2 (ALAS-2024-1929)

The version of glib2 installed on the remote host is prior to 2.36.3-5.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1929 advisory. GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in goptiongroupaddentries. NOTE: the...

Important: dnsmasq

Issue Overview: Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses when there is a zone with many DNSKEY and RRSIG records, aka the "KeyTrap" issue. The protocol specification...

Important: emacs

Issue Overview: In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. CVE-2024-30202 Affected Packages: emacs Issue Correction: Run dnf update emacs --releasever 2023.4.20240416 or dnf update --advisory ALAS2023-2024-584...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2024-584)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-584 advisory. In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. CVE-2024-30202 Tenable has extracted the preceding description block directly...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2024-588)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-588 advisory. An issue was found in the CPython zipfile module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the...

Amazon Linux AMI : xorg-x11-server (ALAS-2024-1928)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1928 advisory. The ProcRenderAddGlyphs function calls the AllocateGlyph function to store new glyphs sent by the client to the X server. AllocateGlyph would return a new glyph with refcount=0 and a re-used glyph would en...

Amazon Linux AMI : kernel (ALAS-2023-1883)

The version of kernel installed on the remote host is prior to 4.14.328-174.540. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1883 advisory. 2024-04-11: CVE-2023-42754 was added to this advisory. A race condition between two functions, lmLogClose and txEnd...

CVE-2023-35812

An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 within these specific packages. The fix had only covered cases where an absolute path is passed to scp. When a relative path is used, there is no verificati...

OpenSSH 安全漏洞

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers from the Canadian OpenBSD Project Group. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2024-581)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-581 advisory. A flaw was found in Curl, where it inadvertently kept the SSL session ID for connections in its cache even when the verify status, OCSP stapling test, failed. A subsequent transfer to the same hostname...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2024-577)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-577 advisory. Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2024-582)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-582 advisory. Affected versions of this package are vulnerable to Denial of Service DoS when using arbitrary strings as text input and the number of characters passed into PIL.ImageFont.ImageFont.getmask is over a...

CVE-2023-35812

An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 within these specific packages. The fix had only covered cases where an absolute path is passed to scp. When a relative path is used, there is no verificati...