Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2023-106)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-106 advisory. Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be...

Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2023-133)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-133 advisory. Sudo before 1.9.13p2 has a double free in the per-command chroot feature. CVE-2023-27320 Tenable has extracted the preceding description block directly from the tested product security advisory. Note th...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-127)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-127 advisory. A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines ...

Amazon Linux 2023 : dbus, dbus-common, dbus-daemon (ALAS2023-2023-100)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-100 advisory. An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus t...

Amazon Linux 2023 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2023-2023-087)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-087 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control...

Amazon Linux 2023 : libsolv, libsolv-demo, libsolv-devel (ALAS2023-2023-013)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-013 advisory. A flaw was found in libsolv. A buffer overflow vulnerability could cause a denial of service. The highest threat from this vulnerability is to system availability. CVE-2021-3200 Tenable has extracted th...

Amazon Linux 2023 : rsyslog, rsyslog-crypto, rsyslog-elasticsearch (ALAS2023-2023-001)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-001 advisory. A flaw was found in the way rsyslog handled invalid log message priority values. In certain configurations, a local attacker, or a remote attacker able to connect to the rsyslog port, could use...

Amazon Linux 2023 : device-mapper-multipath, device-mapper-multipath-devel, device-mapper-multipath-libs (ALAS2023-2023-126)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-126 advisory. A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local user...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2023-102)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-102 advisory. A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the SProcRenderCompositeGlyphs function due to improper validation of the request length. CVE-2021-4008 A fla...

Amazon Linux 2023 : openexr, openexr-devel, openexr-libs (ALAS2023-2023-022)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-022 advisory. 2024-02-15: CVE-2021-20304 was added to this advisory. A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR...

Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2023-103)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-103 advisory. Integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested f...

Amazon Linux 2023 : polkit, polkit-devel, polkit-libs (ALAS2023-2023-026)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-026 advisory. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users...

Amazon Linux 2023 : rsync, rsync-daemon (ALAS2023-2023-002)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-002 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large numbe...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-059)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-059 advisory. 2024-02-15: CVE-2021-33037 was added to this advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request heade...

Amazon Linux 2023 : e2fsprogs, e2fsprogs-devel, e2fsprogs-libs (ALAS2023-2023-044)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-044 advisory. An out-of-bounds read/write vulnerability was found in e2fsprogs. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem. CVE-2022-1304 Tenable...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2023-057)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-057 advisory. A flaw was found in python-pillow. The vulnerability occurs due to improper initialization of image paths, leading to a buffer over-read and improper initialization. This flaw allows an attacke...

Amazon Linux 2023 : ncurses, ncurses-base, ncurses-c++-libs (ALAS2023-2023-023)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-023 advisory. The ncurses package tic is susceptible to a heap overflow on crafted input. When the terminfo entry- description compiler processes input, proper bounds checking was not enforced leading to thi...

Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-121)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-121 advisory. ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image e.g., for resize, the convert process could be left waiting for stdin input. CVE-2022-44267 ImageMagick...

Amazon Linux 2023 : python3-lxml (ALAS2023-2023-034)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-034 advisory. There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using...

Amazon Linux 2023 : aws-nitro-enclaves-cli, aws-nitro-enclaves-cli-devel, aws-nitro-enclaves-cli-integration-tests (ALAS2023-2023-129)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-129 advisory. Hyperium Hyper before 0.14.19 does not allow for customization of the maxheaderlistsize method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. CVE-2022-31394 Tenable has...