Amazon Linux 2 : golang-googlecode-net (ALAS-2022-1861)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1861 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2 : golang-googlecode-sqlite (ALAS-2022-1862)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1862 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2 : golang-github-kr-pty (ALAS-2022-1864)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1864 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2022-1867)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.17+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1867 advisory. Title: Wider MultiByte conversionsBuffer overflow is possible due to incorrect byte count should be...

Amazon Linux AMI : vim (ALAS-2022-1639)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1639 advisory. A flaw was found in vim, which is vulnerable to an out-of-bounds read in the msgouttransspecial function. This flaw allows a specially crafted file to crash software or execute code when opened in...

Amazon Linux 2022 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2022-2022-153)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-153 advisory. Title: Wider MultiByte conversionsBuffer overflow is possible due to incorrect byte count should be charactercount. CVE-2022-21618 Title: Improve NTLM supportwriteSecurityBuffer writes a...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2022-1866)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.5+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1866 advisory. Title: Wider MultiByte conversionsBuffer overflow is possible due to incorrect byte count should be...

Amazon Linux 2 : glibc (ALAS-2022-1857)

The version of glibc installed on the remote host is prior to 2.26-61. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1857 advisory. A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd may lead to memory corruption when the size of the...

Amazon Linux 2 : vim (ALAS-2022-1868)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1868 advisory. A flaw was found in vim, which is vulnerable to an out-of-bounds read in the msgouttransspecial function. This flaw allows a specially crafted file to crash software or execute code when opened i...

Amazon Linux 2022 : containerd, containerd-stress (ALAS2022-2022-156)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-156 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This...

Amazon Linux 2022 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2022-2022-151)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-151 advisory. Title: Wider MultiByte conversionsBuffer overflow is possible due to incorrect byte count should be charactercount. CVE-2022-21618 Title: Improve NTLM supportwriteSecurityBuffer writes a...

Amazon Linux 2022 : freetype, freetype-demos, freetype-devel (ALAS2022-2022-154)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-154 advisory. A heap buffer overflow flaw was found in Freetype's sfntinitface function in the sfobjs.c file. The vulnerability occurs when creating a face with a strange file and invalid index. This flaw...

Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-155)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-155 advisory. A use-after-free vulnerability was found in vim's docmdline function of the src/exdocmd.c file. The issue triggers when an invalid line number on :for is ignored. This flaw allows an attacker t...

Amazon Linux 2022 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2022-2022-152)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-152 advisory. Title: Wider MultiByte conversionsBuffer overflow is possible due to incorrect byte count should be charactercount. CVE-2022-21618 Title: Improve NTLM supportwriteSecurityBuffer writes a...

Denial Of Service (DoS)

libtiff.so amazon linux is vulnerable to denial of service. The vulnerability exists because an invalid range may be passed as an argument to the memset function within TIFFFetchStripThing of tifdirread.c which allows an attacker to cause an application crash passing a malicious TIFF file...

Amazon Linux 2 : containerd, docker (ALASDOCKER-2022-021)

The version of containerd installed on the remote host is prior to 1.6.6-1. The version of docker installed on the remote host is prior to 20.10.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2022-021 advisory. In net/http in Go before 1.18.6 and 1.19.x befor...

Amazon Linux 2 : runc (ALASDOCKER-2022-020)

The version of runc installed on the remote host is prior to 1.1.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2022-020 advisory. Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4...

Amazon Linux 2022 : rsync, rsync-daemon (ALAS2022-2022-148)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-148 advisory. A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitrary files in the client's rsync target...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-020 (ALASKERNEL-5.10-2022-020)

The version of kernel installed on the remote host is prior to 5.10.144-127.601. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-020 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free...

Amazon Linux 2022 : lua, lua-devel, lua-libs (ALAS2022-2022-146)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-146 advisory. A heap buffer-overflow vulnerability was found in Lua. The flaw occurs due to vulnerable code present in the lparser.c function of Lua that allows the execution of untrusted Lua code into a...