Medium: samba

Issue Overview: A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file or printer instead of client-supplied data. The client cannot control th...

Medium: qt5-qtbase

Issue Overview: In QT, there is an integer overflow in qfixedp.h when rendering SVG image on the minimal plugin. CVE-2023-32763 Affected Packages: qt5-qtbase Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...

CVE-2023-33777

The CVE-2023-33777 issue affects Prestashop Amazon (plugin) before v5.2.24. Affected component: /functions/fbaorder.php. Root cause: directory traversal vulnerability that could be exploited to access restricted files. Impact is described as a directory traversal attack; explicit exploit details ...

Important: apache-ivy

Issue Overview: When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which ar...

Medium: libicu60

Issue Overview: International Components for Unicode ICU-20850 v66.1 was discovered to contain a use after free bug in the pkgcreateWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. CVE-2020-21913 Affected Packages: libicu60 Note: This advisory is applicable to Amazon Linux 2 AL2...

Medium: SDL2

Issue Overview: A memory leak issue was discovered in SDL2 version = SDL2-2.0.8. CVE-2022-4743 Affected Packages: SDL2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: R...

A week in security (July 17 - 23)

Last week on Malwarebytes Labs: CISA: You've got two weeks to patch Citrix NetScaler vulnerability CVE-2023-3519 Estee Lauder targeted by Cl0p and BlackCat ransomware groups Google fixes "Bad.Build" Cloud Build flaw, researchers say it's not enough Accidental VirusTotal upload is a valuable...

PT-2023-3704 · Amd +9 · Amd Ryzen +10

Name of the Vulnerable Software and Affected Versions: AMD Zen 2 processors affected versions not specified Description: The issue in AMD Zen 2 processors, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. This is due to a...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2023-007)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0382.b05-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2023-007 advisory. Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affecte...

Important: kernel

Issue Overview: A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAPNETADMIN capability to crash o...

Amazon in-van delivery driver footage makes its way online

Footage from technology used to monitor Amazon delivery drivers is leaking onto the internet. AI-enabled equipment which keeps an eye on the drivers speed, location, and other activities is part of the growing trend of workplace surveillance. In theory where drivers are concerned it could flag a...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-242)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-242 advisory. .NET Denial of Service Vulnerability. CVE-2023-21538 .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability CVE-2023-24895 .NET, .NET Framework, and Visual Studio Elevation...

Amazon Linux 2 : tcpdump (ALAS-2023-2119)

The version of tcpdump installed on the remote host is prior to 4.9.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2119 advisory. The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrpprint for VRRP version 3, a different...

Amazon Linux 2023 : docker (ALAS2023-2023-260)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-260 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

Amazon Linux AMI : ImageMagick (ALAS-2023-1781)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1781 advisory. stack overflow when parsing malicious tiff image CVE-2023-3195 The upstream bug report describes this issue as...

Amazon Linux 2 : wireshark (ALAS-2023-2113)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2113 advisory. Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an...

Amazon Linux 2023 : bsdcat, bsdcpio, bsdtar (ALAS2023-2023-246)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-246 advisory. In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference...

Amazon Linux 2 : gstreamer-plugins-good (ALAS-2023-2122)

The version of gstreamer-plugins-good installed on the remote host is prior to 0.10.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2122 advisory. Integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-238)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-238 advisory. The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that th...

Amazon Linux 2 : compat-libtiff3 (ALAS-2023-2125)

The version of compat-libtiff3 installed on the remote host is prior to 3.9.4-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2125 advisory. A NULL pointer dereference in TIFFClose is caused by a failure to open an output file non-existent path or a path that...