Amazon Linux 2022 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2022-2022-043)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-043 advisory. A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severit...

Amazon Linux 2022 : qemu, qemu-audio-alsa, qemu-audio-oss (ALAS2022-2022-050)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-050 advisory. A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create files with an unintended group ownership and with group execution...

Amazon Linux 2022 : cyrus-sasl, cyrus-sasl-devel, cyrus-sasl-gs2 (ALAS2022-2022-035)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-035 advisory. A flaw was found in the SQL plugin shipped with Cyrus SASL. Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands. This issue can lead to the escalation of...

Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-065)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-065 advisory. A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials s...

Amazon Linux 2022 : python3-lxml (ALAS2022-2022-074)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-074 advisory. There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using python-lxml's...

Amazon Linux 2022 : libblkid, libblkid-devel, libfdisk (ALAS2022-2022-099)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-099 advisory. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to...

Amazon Linux 2022 : wireshark-cli, wireshark-devel (ALAS2022-2022-079)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-079 advisory. A NULL pointer exception flaw was found in Wireshark. A process failure on crafted or malformed input in the IPPUSB dissector can cause a denial of service via a packet injection or a crafted...

Amazon Linux 2022 : microcode_ctl (ALAS2022-2022-070)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-070 advisory. Sensitive information accessible by physical probing of JTAG interface for some IntelR Processors with SGX may allow an unprivileged user to potentially enable information disclosure via physic...

Amazon Linux 2022 : libxml2, libxml2-devel, libxml2-static (ALAS2022-2022-068)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-068 advisory. valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. CVE-2022-23308 A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-042)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-042 advisory. A flaw was found in the Linux kernel in linux/net/netfilter/nftablesapi.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. CVE-2022-1015 A flaw w...

Amazon Linux 2022 : polkit, polkit-devel, polkit-libs (ALAS2022-2022-097)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-097 advisory. There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion.The highest threat from this vulnerability is to availability. NOTE:...

Amazon Linux 2022 : fish (ALAS2022-2022-056)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-056 advisory. fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of gi...

Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-055)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-055 advisory. A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials s...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-083)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-083 advisory. A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF. This flaw...

Amazon Linux 2022 : pcre2, pcre2-devel, pcre2-static (ALAS2022-2022-071)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-071 advisory. An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath function of the pcre2jitcompile.c file. This involves a unicode property matching issue ...

Amazon Linux 2022 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2022-2022-120)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-120 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : libsolv, libsolv-demo, libsolv-devel (ALAS2022-2022-093)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-093 advisory. A flaw was found in libsolv. A buffer overflow vulnerability could cause a denial of service. The highest threat from this vulnerability is to system availability. CVE-2021-3200 Tenable has extracted th...

Amazon Linux 2022 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2022-2022-113)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-113 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : zsh, zsh-html (ALAS2022-2022-117)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-117 advisory. A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code execution if they control a command output inside the prompt, as stated by ...

Amazon Linux 2022 : php, php-bcmath, php-cli (ALAS2022-2022-073)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-073 advisory. A flaw was found in php. The main cause of this vulnerability is improper input validation while parsing an Extensible Markup LanguageXML entity. A special character could allow an attacker to...