Amazon Linux 2022 : openexr, openexr-devel, openexr-libs (ALAS2022-2022-061)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-061 advisory. An integer overflow could occur when OpenEXR processes a crafted file on systems where sizet is less than 64 bits. This issue could cause an invalid bytesPerLine and maxBytesPerLine value, whic...

Amazon Linux 2022 : clamav, clamav-data, clamav-devel (ALAS2022-2022-090)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-090 advisory. A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause...

Amazon Linux 2022 : httpd, httpd-core, httpd-devel (ALAS2022-2022-110)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-110 advisory. An HTTP request smuggling vulnerability was found in the modproxyajp module of httpd. This flaw allows an attacker to smuggle requests to the AJP server, where it forwards requests...

Amazon Linux 2022 : fribidi, fribidi-devel (ALAS2022-2022-091)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-091 advisory. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory...

Amazon Linux 2022 : bsdcat, bsdcpio, bsdtar (ALAS2022-2022-059)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-059 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provid...

Amazon Linux 2022 : cups, cups-client, cups-devel (ALAS2022-2022-108)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-108 advisory. An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as...

Amazon Linux 2022 : openssl (ALAS2022-2022-104)

The version of openssl installed on the remote host is prior to 3.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-104 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is...

Amazon Linux 2022 : libtiff, libtiff-devel, libtiff-static (ALAS2022-2022-094)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-094 advisory. A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a hea...

Amazon Linux 2022 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2022-2022-069)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-069 advisory. MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW. CVE-2021-46659 MariaDB through 10.5.9 allows an application cras...

Amazon Linux 2022 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2022-2022-112)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-112 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2022-2022-089)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-089 advisory. A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local attackers gaining root privileges. CVE-2022-27239 A flaw was found...

Amazon Linux 2022 : freerdp, freerdp-devel, freerdp-libs (ALAS2022-2022-082)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-082 advisory. A flaw was found in the FreeRDP client when it fails to validate input data when using gateway connections. This flaw could allow a malicious gateway to send a specially crafted input to a clie...

Amazon Linux 2022 : git, git-all, git-core (ALAS2022-2022-118)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-118 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration...

Amazon Linux 2022 : systemd, systemd-container, systemd-devel (ALAS2022-2022-052)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-052 advisory. A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. CVE-2021-3997 Tenable has...

Amazon Linux 2022 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2022-2022-121)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-121 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : clamav, clamav-data, clamav-devel (ALAS2022-2022-063)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-063 advisory. A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial...

Amazon Linux 2022 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2022-2022-111)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-111 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : kernel-livepatch-5.15.29-16.111 (ALAS2022-2022-101)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-101 advisory. A use-after-free flaw was found in the Linux kernel's iouring interface subsystem in the way a user triggers a race condition between timeout flush and removal. This flaw allows a local user to crash or...

Amazon Linux 2022 : systemd, systemd-container, systemd-devel (ALAS2022-2022-040)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-040 advisory. A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. CVE-2021-3997 Tenable has...

Amazon Linux 2022 : cryptsetup, cryptsetup-devel, cryptsetup-libs (ALAS2022-2022-064)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-064 advisory. It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk...