Amazon Linux 2023 : libblkid, libblkid-devel, libfdisk (ALAS2023-2023-024)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-024 advisory. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to...

Amazon Linux 2023 : libXpm, libXpm-devel (ALAS2023-2023-107)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-107 advisory. A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Deni...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-120)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-120 advisory. Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file CVE-2022-4344 Infinite loo...

Amazon Linux 2023 : dnsmasq, dnsmasq-utils (ALAS2023-2023-039)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-039 advisory. A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-122)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-122 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its...

Amazon Linux 2023 : zsh, zsh-html (ALAS2023-2023-035)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-035 advisory. A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code execution if they control a command output inside the prompt, as stated by ...

Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2023-089)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-089 advisory. SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. CVE-2022-35737 Tenable has extracted the preceding...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-053)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-053 advisory. A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an initdeviceprocs...

Amazon Linux 2023 : openjpeg2, openjpeg2-devel, openjpeg2-tools (ALAS2023-2023-040)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-040 advisory. There is a flaw in the opj2compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2compress, could trigger a heap...

Amazon Linux 2023 : unzip (ALAS2023-2023-029)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-029 advisory. A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially...

Amazon Linux 2023 : flac, flac-devel, flac-libs (ALAS2023-2023-008)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-008 advisory. An out-of-bounds write vulnerability was found in libFlak. The vulnerability occurs due to a missing bounds check. This flaw allows a local attacker without additional execution privileges to cause loca...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2023-078)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-078 advisory. NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by targeting an Unbound instance. Unbound is queri...

Amazon Linux 2023 : python3-lxml (ALAS2023-2023-034)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-034 advisory. There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using...

Medium: audiofile

Issue Overview: In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo function calls the copyrightstring function to get data, however, it dosn...

Amazon Linux 2023 : python3-jwt, python3-jwt+crypto (ALAS2023-2023-076)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-076 advisory. A vulnerability was found in python-jwt. This issue happens when PyJWT supports multiple different JWT signing algorithms. This flaw allows an attacker submitting the JWT token to choose the used signin...

Amazon Linux 2023 : giflib, giflib-devel, giflib-utils (ALAS2023-2023-075)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-075 advisory. An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over- read. CVE-2020-23922 There is a heap-buffer-overflow in GIFLIB 5.2.1 function...

Medium: openjpeg

Issue Overview: A heap-based buffer overflow was found in OpenJPEG. This flaw allows an attacker to execute arbitrary code with the permissions of the application compiled against OpenJPEG. CVE-2021-3575 Affected Packages: openjpeg Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Important: tar

Issue Overview: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in fromheader in list.c via a V7 archive in which mtime has approximate...

Low: vim

Issue Overview: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. CVE-2023-1127 Affected Packages: vim Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run...

Low: ghostscript

Issue Overview: Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. CVE-2019-25059 Affected Packages: ghostscript Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...