Amazon Linux 2022 : httpd, httpd-core, httpd-devel (ALAS2022-2022-053)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-053 advisory. A flaw was found in the modlua module of httpd. A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function. The...

Amazon Linux 2022 : libinput, libinput-devel, libinput-test (ALAS2022-2022-092)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-092 advisory. A format string vulnerability was found in libinput CVE-2022-1215 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not teste...

Amazon Linux 2022 : containerd, containerd-stress (ALAS2022-2022-088)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-088 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause...

Amazon Linux 2022 : minizip-compat, minizip-compat-devel, zlib (ALAS2022-2022-100)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-100 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large number of...

Amazon Linux 2022 : cpp, gcc, gcc-c++ (ALAS2022-2022-057)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-057 advisory. A flaw was found in the way Unicode standards are implemented in the context of development environments, which have specialized requirements for rendering text. An attacker could exploit this to deceiv...

Amazon Linux 2022 : openssl, openssl-devel, openssl-libs (ALAS2022-2022-123)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-123 advisory. A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through...

Amazon Linux 2022 : containerd, containerd-stress, docker (ALAS2022-2022-054)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-054 advisory. A flaw was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with...

Amazon Linux 2022 : rsyslog, rsyslog-crypto, rsyslog-elasticsearch (ALAS2022-2022-075)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-075 advisory. A flaw was found in the way rsyslog handled invalid log message priority values. In certain configurations, a local attacker, or a remote attacker able to connect to the rsyslog port, could use...

Amazon Linux 2022 : polkit, polkit-devel, polkit-libs (ALAS2022-2022-102)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-102 advisory. There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion.The highest threat from this vulnerability is to availability. NOTE:...

Amazon Linux 2022 : expat, expat-devel, expat-static (ALAS2022-2022-036)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-036 advisory. An integer overflow was found in expat. The issue occurs in storeRawNames by abusing the mbuffer expansion logic to allow allocations very close to INTMAX and out-of-bounds heap writes. This fl...

Amazon Linux 2022 : logrotate (ALAS2022-2022-095)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-095 advisory. A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock...

Amazon Linux 2022 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2022-2022-080)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-080 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This...

Amazon Linux 2022 : postgresql14, postgresql14-contrib, postgresql14-llvmjit (ALAS2022-2022-124)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-124 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH...

Amazon Linux 2022 : openjpeg2, openjpeg2-devel, openjpeg2-tools (ALAS2022-2022-122)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-122 advisory. A flaw was found in the opj2decompress program in openjpeg2 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of t...

Amazon Linux 2022 : libblkid, libblkid-devel, libfdisk (ALAS2022-2022-086)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-086 advisory. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to...

Amazon Linux 2022 : java-11-openjdk, java-11-openjdk-demo, java-11-openjdk-devel (ALAS2022-2022-047)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-047 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311,...

Amazon Linux 2022 : php, php-bcmath, php-cli (ALAS2022-2022-085)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-085 advisory. A flaw was found in PHP. The vulnerability occurs due to the malformed phpfilterfloat function and leads to a use-after-free vulnerability. This flaw allows an attacker to inject a malicious file, leadi...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-039)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-039 advisory. Amazon Linux has been made aware of a potential Branch Target Injection BTI issue sometimes referred to as Spectre variant 2. This is a known cross-domain transient execution attack where a thi...

Amazon Linux 2022 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2022-2022-119)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-119 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2022-2022-126)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-126 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control...