Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-012 (ALASKERNEL-5.15-2023-012)

The version of kernel installed on the remote host is prior to 5.15.86-53.137. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-012 advisory. A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request...

Amazon Linux 2 : squid (ALAS-2023-1907)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1907 advisory. In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-025)

The version of kernel installed on the remote host is prior to 5.10.162-141.675. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-025 advisory. A vulnerability classified as problematic has been found in Linux Kernel. This affects the function...

Amazon Linux 2 : bcel (ALAS-2023-1916)

The version of bcel installed on the remote host is prior to 5.2-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1916 advisory. Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an...

Amazon Linux 2 : pcs (ALAS-2023-1905)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1905 advisory. A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2023-1918)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.18+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1918 advisory. Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens...

Amazon Linux 2 : golist (ALAS-2023-1913)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1913 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2023-1919)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.6+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1919 advisory. Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens...

Amazon Linux 2 : freetype (ALAS-2023-1909)

The version of freetype installed on the remote host is prior to 2.8-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1909 advisory. A heap buffer overflow flaw was found in Freetype's sfntinitface function in the sfobjs.c file. The vulnerability occurs...

Amazon Linux 2 : xorg-x11-server (ALAS-2023-1910)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1910 advisory. A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow...

Amazon Linux 2 : vim (ALAS-2023-1912)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1912 advisory. The target's backtrace indicates that libc has detected a heap error or that the target was executing a heap function when it stopped. This could be due to heap corruption, passing a bad pointer to a heap...

Amazon Linux 2 : sqlite (ALAS-2023-1911)

The version of sqlite installed on the remote host is prior to 3.7.17-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1911 advisory. SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string...

Medium: java-11-amazon-corretto

Issue Overview: Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens opportunities for DoS. CVE-2023-21835 Better Banking of Sounds: JARSoundbankReader can load classes from remote URLs. CVE-2023-21843 Affected Packages: java-11-amazon-corretto Note:...

Medium: pcs

Issue Overview: A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data...

Medium: java-17-amazon-corretto

Issue Overview: Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens opportunities for DoS. CVE-2023-21835 Better Banking of Sounds: JARSoundbankReader can load classes from remote URLs. CVE-2023-21843 Affected Packages: java-17-amazon-corretto Note:...

Important: golist

Issue Overview: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...

Important: libtasn1

Issue Overview: GNU Libtasn1 before 4.19.0 has an ETYPEOK off-by-one array size check that affects asn1encodesimpleder. CVE-2021-46848 Affected Packages: libtasn1 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core an...

Important: xorg-x11-server

Issue Overview: A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of th...

Important: bcel

Issue Overview: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllab...

Important: sqlite

Issue Overview: SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. CVE-2022-35737 Affected Packages: sqlite Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...