Medium: util-linux

Issue Overview: A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error...

Important: device-mapper-multipath

Issue Overview: multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to loc...

Important: expat

Issue Overview: In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. CVE-2022-43680 Affected Packages: expat Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...

Medium: 389-ds-base

Issue Overview: A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. CVE-2022-2850 Affected Packages...

Medium: ncurses

Issue Overview: The ncurses package tic is susceptible to a heap overflow on crafted input. When the terminfo entry-description compiler processes input, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is system availability...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1876 (ALAS-2022-1876)

The version of kernel installed on the remote host is prior to 4.14.296-222.539. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1876 advisory. In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk-skrxdst to RCU rules...

Amazon Linux 2 : libtiff (ALAS-2022-1872)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1872 advisory. 2023-10-25: CVE-2022-2869 was added to this advisory. 2023-10-12: CVE-2022-2868 was added to this advisory. A flaw was...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-038 (ALASKERNEL-5.4-2022-038)

The version of kernel installed on the remote host is prior to 5.4.219-126.410. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-038 advisory. A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function...

Amazon Linux 2 : dhcp (ALAS-2022-1874)

The version of dhcp installed on the remote host is prior to 4.2.5-79. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1874 advisory. An integer overflow vulnerability was found in the DHCP server. When the optioncodehashlookup function is called from...

Amazon Linux 2 : rsync (ALAS-2022-1873)

The version of rsync installed on the remote host is prior to 3.1.2-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1873 advisory. A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can cop...

Amazon Linux 2 : expat (ALAS-2022-1877)

The version of expat installed on the remote host is prior to 2.1.0-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1877 advisory. A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while...

Amazon Linux 2 : curl (ALAS-2022-1875)

The version of curl installed on the remote host is prior to 7.79.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1875 advisory. A vulnerability was found in curl. This issue occurs because a malicious server can serve excessive amounts of Set-Cookie:...

Amazon Linux 2 : pcre2 (ALAS-2022-1871)

The version of pcre2 installed on the remote host is prior to 10.23-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1871 advisory. An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath function of the...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-022 (ALASKERNEL-5.10-2022-022)

The version of kernel installed on the remote host is prior to 5.10.149-133.644. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-022 advisory. A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function...

Amazon Linux 2 : glibc (ALAS-2022-1869)

The version of glibc installed on the remote host is prior to 2.26-62. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1869 advisory. In the GNU C Library aka glibc or libc6 before 2.28, parseregexp in posix/regcomp.c misparses alternatives, which allows...

Amazon Linux 2 : dbus (ALAS-2022-1870)

The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1870 advisory. A flaw was found in dbus. The implementation of DBUSCOOKIESHA1 is susceptible to a symbolic link attack. A malicious client...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-010)

The version of kernel installed on the remote host is prior to 5.15.75-48.135. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-010 advisory. drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information...

Medium: glibc

Issue Overview: In the GNU C Library aka glibc or libc6 before 2.28, parseregexp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service assertion failure and application exit or trigger an incorrect result by attempting a regular-expression match...

Important: expat

Issue Overview: A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XMLResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some...

Medium: dhcp

Issue Overview: An integer overflow vulnerability was found in the DHCP server. When the "optioncodehashlookup" function is called from "addoption", it increases the option's "refcount" field. However, there is not a corresponding call to "optiondereference" to decrement the "refcount" field. The...