Medium: gsl

Issue Overview: A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing a maliciously crafted input data for gslstatsquantilefromsorteddata of the library may lead to unexpected application...

Important: open-vm-tools

Issue Overview: VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the-middle MITM network positioning between vCenter server and the virtual machine may be able to bypass SAML token signature verification, to perform VMware Tools Guest Operations...

Medium: libxml2

Issue Overview: Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service DoS via supplying a crafted XML file. CVE-2023-39615 Affected Packages: libxml2 Note...

Important: libssh2

Issue Overview: An issue was discovered in function libssh2packetadd in libssh2 1.10.0 allows attackers to access out of bounds memory. CVE-2020-22218 Affected Packages: libssh2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Medium: elfutils

Issue Overview: The libcpu component which is used by libasm of elfutils version 0.177 git 47780c9e, suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write CWE-787, off-by-one error CWE-193 and reachable assertion CWE-617; to exploit the vulnerabilit...

Amazon Linux 2 : libtiff, --advisory ALAS2-2023-2263 (ALAS-2023-2263)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2263 advisory. The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service invalid read and...

Amazon Linux 2 : exempi (ALAS-2023-2260)

The version of exempi installed on the remote host is prior to 2.2.0-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2260 advisory. Buffer Overflow vulnerability in function ID3Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers ...

Amazon Linux 2 : ghostscript (ALAS-2023-2261)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2261 advisory. A buffer overflow vulnerability in pcxwriterle in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remo...

Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2023-343)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-343 advisory. Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service DoS v...

Amazon Linux 2 : qt5-qtbase (ALAS-2023-2252)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2252 advisory. Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory...

Amazon Linux 2023 : gsl, gsl-devel (ALAS2023-2023-353)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-353 advisory. A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing a maliciously crafted input data for...

Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-350)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-350 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the- middle MITM network positioning between vCenter server and the virtual machine may be able to bypass...

Amazon Linux 2023 : docker (ALAS2023-2023-345)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-345 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now...

Amazon Linux 2 : opensc (ALAS-2023-2262)

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2262 advisory. OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decodebitstring in libopensc/asn1.c...

Important: ghostscript

Issue Overview: Buffer Overflow vulnerability in cljmediasize function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers to cause a denial of service or other unspecified impacts via opening of crafted PDF document. CVE-2020-21890 Affected Packages: ghostscript Note: This...

Medium: qt5-qtbase

Issue Overview: Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. CVE-2022-25634 An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion...

Medium: libtiff

Issue Overview: An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. CVE-2022-40090 Affected Packages: libtiff Issue Correction: Run dnf update libtiff --releasever 2023.2.20230920 or dnf update --advisory...

Important: thunderbird

Issue Overview: Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file...

Amazon Linux 2 : thunderbird (ALAS-2023-2248)

The version of thunderbird installed on the remote host is prior to 102.15.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2248 advisory. Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be...

Amazon Linux 2 : libxml2 (ALAS-2023-2249)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2249 advisory. Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement function at /libxml2/SAX2.c...