Amazon Linux AMI : xorg-x11-server (ALAS-2023-1702)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1702 advisory. A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo and ProcXkbGetDeviceInfo to read and write into freed...

Amazon Linux 2 : thunderbird (ALAS-2023-1988)

The version of thunderbird installed on the remote host is prior to 102.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1988 advisory. The Mozilla Foundation describes this issue as follows: Sometimes, when invalidating JIT code while following an...

Amazon Linux 2 : tar (ALAS-2023-1994)

The version of tar installed on the remote host is prior to 1.26-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1994 advisory. GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-014)

The version of kernel installed on the remote host is prior to 5.15.93-55.139. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-014 advisory. 2023-11-09: CVE-2023-3567 was added to this advisory. A flaw was found in the Linux kernel's Layer 2...

Amazon Linux 2 : bind (ALAS-2023-2001)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2001 advisory. A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-043 (ALASKERNEL-5.4-2023-043)

The version of kernel installed on the remote host is prior to 5.4.235-144.344. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-043 advisory. A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L...

Medium: openjpeg

Issue Overview: A heap-based buffer overflow was found in OpenJPEG. This flaw allows an attacker to execute arbitrary code with the permissions of the application compiled against OpenJPEG. CVE-2021-3575 Affected Packages: openjpeg Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Important: nss

Issue Overview: firefox-esr , thunderbird and nss only are affected by this package. CVE-2023-0767 Affected Packages: nss Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction...

Medium: python3

Issue Overview: An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. CVE-2023-24329 Affected Packages: python3 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-095)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-095 advisory. If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems most widely: Windows this...

Amazon Linux 2023 : python3-certifi (ALAS2023-2023-062)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-062 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from...

Amazon Linux 2023 : minizip-compat, minizip-compat-devel, zlib (ALAS2023-2023-003)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-003 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large numbe...

Amazon Linux 2023 : protobuf-c, protobuf-c-compiler, protobuf-c-devel (ALAS2023-2023-086)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-086 advisory. A flaw was found in protobuf-c. The issue occurs due to an invalid arithmetic shift via the parsetagandwiretype in the protobuf-c/protobuf-c.c function. This flaw allows attackers to cause a denial of...

Amazon Linux 2023 : dbus-broker (ALAS2023-2023-080)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-080 advisory. An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line. c-shquote contains a stack-based buffer over-read if a malicious Exec lin...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2023-131)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-131 advisory. A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo and ProcXkbGetDeviceInfo to read and write into...

Amazon Linux 2023 : python3-subversion, subversion, subversion-devel (ALAS2023-2023-011)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-011 advisory. A flaw was found in Subversion. When using path-based authorization authz, the helper function detectchanged does not omit potentially sensitive information from log messages. In particular, if...

Amazon Linux 2023 : bash, bash-devel (ALAS2023-2023-091)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-091 advisory. A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parametertransform. This issue may lead to memory problems. CVE-2022-3715 Tenable has extracted the preceding...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2023-072)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-072 advisory. There's a null pointer dereference and server-side request forgery flaw in httpd's modproxy module, when it is configured to be used as a forward proxy. A crafted packet could be sent on the...

Amazon Linux 2023 : cryptsetup, cryptsetup-devel, cryptsetup-libs (ALAS2023-2023-027)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-027 advisory. It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk...

Amazon Linux 2023 : libsepol, libsepol-devel, libsepol-static (ALAS2023-2023-017)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-017 advisory. The CIL compiler in SELinux 3.2 has a use-after-free in cilverifyclassperms called from cilverifyclasspermission and cilpreverifyhelper. CVE-2021-36084 The CIL compiler in SELinux 3.2 has a...