Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-330)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-330 advisory. A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. CVE-2023-20588 The fix for XSA-423 added logic to Linux'es netback...

Amazon Linux 2 : curl (ALAS-2023-2230)

The version of curl installed on the remote host is prior to 8.2.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2230 advisory. Integer overflow vulnerability in tooloperate.c in curl 7.65.2 via crafted value as the retry delay. CVE-2020-19909 libcurl...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2023-322)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-322 advisory. IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or . If an...

Amazon Linux 2 : hwloc (ALAS-2023-2237)

The version of hwloc installed on the remote host is prior to 1.11.8-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2237 advisory. An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via...

Medium: ImageMagick

Issue Overview: ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw. CVE-2023-39978 Affected Packages: ImageMagick Issue Correction: Run dnf update ImageMagick --releasever 2023.1.20230906 or dnf update --advisory ALAS2023-2023-320...

Medium: gdk-pixbuf2

Issue Overview: GNOME GdkPixbuf aka GDK-PixBuf before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c compositeframe. This overflow is controllable and could be abused for code execution, especially on 32-bit...

Important: rust

Issue Overview: Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files...

Important: python3.9

Issue Overview: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer...

Important: php8.2

Issue Overview: In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it ...

Medium: dmidecode

Issue Overview: Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. CVE-2023-30630 Affected Packages: dmidecode Issue Correction: Run dnf update dmidecode --releasever 2023.1.20230906 or d...

Important: postgresql15

Issue Overview: IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an...

Important: amazon-ecr-credential-helper

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: amazon-ecr-credential-helper Issue Correction: Run dnf update amazon-ecr-credential-helper --releasever 2023.1.20230906 or dnf update --advisory ALAS2023-2023-337 --releasever 2023.1.202309...

Important: cni-plugins

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-052 (ALASKERNEL-5.4-2023-052)

The version of kernel installed on the remote host is prior to 5.4.254-169.358. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-052 advisory. A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss ...

Amazon Linux 2 : runc (ALASECS-2023-005)

The version of runc installed on the remote host is prior to 1.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-005 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2023-006)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.26.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-006 advisory. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-026 (ALASKERNEL-5.15-2023-026)

The version of kernel installed on the remote host is prior to 5.15.128-80.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-026 advisory. Information exposure through microarchitectural state after transient execution in certain vector executi...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-023)

The version of kernel installed on the remote host is prior to 5.15.43-20.103. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-023 advisory. 2024-03-13: CVE-2022-48619 was added to this advisory. 2023-10-12: CVE-2021-3923 was added to this advisor...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-036)

The version of kernel installed on the remote host is prior to 5.10.112-108.499. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-036 advisory. In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-039 (ALASKERNEL-5.10-2023-039)

The version of kernel installed on the remote host is prior to 5.10.192-182.736. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-039 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdmaaddrcancel...