Amazon Linux 2 : curl, libcurl, libcurl-devel (ALAS-2023-1924)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1924 advisory. A vulnerability was found in curl. This issue occurs due to an erroneous function. A malicious server could make curl within Network Security Services NSS get stuck in a never-ending busy loop wh...

Amazon Linux AMI : emacs-git, emacs-git-el, git (ALAS-2023-1679)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1679 advisory. Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository,...

Amazon Linux 2 : git, git-all, git-core (ALAS-2023-1923)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1923 advisory. Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository...

Amazon Linux 2 : vim-common, vim-data, vim-enhanced (ALAS-2023-1927)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1927 advisory. Use After Free in GitHub repository vim/vim prior to 9.0.0882. CVE-2022-4292 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. CVE-2023-0049 Tenable has extracted the preceding...

Amazon Linux AMI : krb5-devel, krb5-libs, krb5-pkinit-openssl (ALAS-2023-1680)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1680 advisory. Integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for...

Amazon Linux 2 : libudisks2, libudisks2-devel, udisks2 (ALAS-2023-1921)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1921 advisory. A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highest threat from this vulnerability is to system availability...

Amazon Linux AMI : sudo, sudo-devel (ALAS-2023-1682)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1682 advisory. In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append...

Amazon Linux AMI : squid, squid-migration-script (ALAS-2023-1677)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1677 advisory. In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses. CVE-2021-46784 A...

Amazon Linux 2 : emacs, emacs-common, emacs-devel (ALAS-2023-1928)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1928 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of...

Amazon Linux AMI : protobuf, protobuf-compiler, protobuf-devel (ALAS-2023-1676)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1676 advisory. A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute...

Amazon Linux 2 : libblkid, libblkid-devel, libfdisk (ALAS-2023-1920)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1920 advisory. DISPUTED An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the...

Important: freerdp

Issue Overview: FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using /parallel command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not...

Medium: golang

Issue Overview: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the...

Important: emacs

Issue Overview: GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags " command suggest...

Medium: vim

Issue Overview: Use After Free in GitHub repository vim/vim prior to 9.0.0882. CVE-2022-4292 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. CVE-2023-0049 Affected Packages: vim Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for...

Medium: autotrace

Issue Overview: Heap-based buffer overflow in the pstoeditsuffixtableinit function in output-pstoedit.c in AutoTrace 0.31.1 allows remote attackers to cause a denial of service out-of-bounds write via a crafted bmp image file. CVE-2016-7392 A biWidthbiBitCnt integer overflow in input-bmp.c in...

Low: util-linux

Issue Overview: DISPUTED An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and...

Important: git

Issue Overview: Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository, which contains a set of file patterns and the attributes that should be set for path...

Amazon Linux 2022 : ctdb, libsmbclient, libsmbclient-devel (ALAS2022-2023-271)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-271 advisory. Integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested f...

Amazon Linux 2022 : wireshark-cli, wireshark-devel (ALAS2022-2023-268)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-268 advisory. Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file CVE-2022-3725 Tenable has extracted the preceding description block...