Amazon Linux 2022 : flatpak, flatpak-devel, flatpak-libs (ALAS2022-2022-179)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-179 advisory. An incorrect authorization vulnerability was found in Flatpak. Flatpak does not properly validate that the permissions displayed to the user for an app at install time match the actual...

Amazon Linux 2022 : openjpeg2, openjpeg2-devel, openjpeg2-tools (ALAS2022-2022-184)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-184 advisory. There is a flaw in the opj2compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2compress, could trigger a heap...

Amazon Linux 2022 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2022-2022-164)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-164 advisory. A divide-by-zero flaw was found in ImageMagick in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a divisio...

Amazon Linux 2022 : pcre2, pcre2-devel, pcre2-static (ALAS2022-2022-191)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-191 advisory. An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath function of the pcre2jitcompile.c file. This involves a unicode property matching issue ...

Amazon Linux 2022 : openssl, openssl-devel, openssl-libs (ALAS2022-2022-195)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-195 advisory. A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command execute...

Amazon Linux 2022 : libxml2, libxml2-devel, libxml2-static (ALAS2022-2022-198)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-198 advisory. valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. CVE-2022-23308 A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the...

Amazon Linux 2022 : bind, bind-chroot, bind-devel (ALAS2022-2022-166)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-166 advisory. A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This...

Amazon Linux 2022 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2022-2022-196)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-196 advisory. A flaw was found in python-pillow. The vulnerability occurs due to improper initialization of image paths, leading to a buffer over-read and improper initialization. This flaw allows an attacke...

Amazon Linux 2022 : vsftpd (ALAS2022-2022-172)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-172 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates...

Amazon Linux 2022 : cups, cups-client, cups-devel (ALAS2022-2022-203)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-203 advisory. An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as...

Amazon Linux 2022 : blas, blas64, blas64_ (ALAS2022-2022-173)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-173 advisory. An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack and OpenBLAS. A specially crafted input passed to these functions could cause an application using lapa...

Amazon Linux 2022 : libsndfile, libsndfile-devel, libsndfile-utils (ALAS2022-2022-175)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-175 advisory. An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file via tricking a user to open or otherwise to an application linke...

Amazon Linux 2022 : gmp, gmp-c++, gmp-devel (ALAS2022-2022-177)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-177 advisory. A flaw was found in gmp. An integer overflow vulnerability could allow an attacker to input an integer value leading to a crash. The highest threat from this vulnerability is to system availability...

Amazon Linux 2022 : jdom, jdom-demo, jdom-javadoc (ALAS2022-2022-168)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-168 advisory. An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. CVE-2021-33813 Tenable has extracted the preceding description block directly...

Amazon Linux 2022 : redis6, redis6-devel (ALAS2022-2022-199)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-199 advisory. A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an attacker with access to Redis to inject Lua code that executes the...

Amazon Linux 2022 : minizip-compat, minizip-compat-devel, zlib (ALAS2022-2022-159)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-159 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large number of...

Amazon Linux 2022 : harfbuzz, harfbuzz-devel, harfbuzz-icu (ALAS2022-2022-181)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-181 advisory. HarfBuzz 2.9.0 has an out-of-bounds write in hbbitsetinvertiblet::set called from hbsparsesett::set and hbsetcopy. CVE-2021-45931 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2022 : postgresql14, postgresql14-contrib, postgresql14-llvmjit (ALAS2022-2022-190)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-190 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH...

Amazon Linux 2022 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2022-2022-182)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-182 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability...

Amazon Linux 2022 : libtiff, libtiff-devel, libtiff-static (ALAS2022-2022-183)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-183 advisory. Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available wi...