Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-320)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-320 advisory. ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw. CVE-2023-39978 Tenable has extracted the preceding description block directly from the test...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2023-337)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-337 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

Amazon Linux 2023 : avahi, avahi-autoipd, avahi-compat-howl (ALAS2023-2023-332)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-332 advisory. avahi-daemon denial of service can be caused by unprivileged users via DBus CVE-2023-1981 Tenable has extracted the preceding description block directly from the tested product security advisory. Note...

Amazon Linux 2023 : hwloc, hwloc-devel, hwloc-gui (ALAS2023-2023-335)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-335 advisory. An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. CVE-2022-47022 Tenable has extracted the...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-327)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-327 advisory. An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to acces...

Amazon Linux 2023 : indent (ALAS2023-2023-318)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-318 advisory. GNU indent 2.2.13 has a heap-based buffer overflow in searchbrace in indent.c via a crafted file. CVE-2023-40305 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : gdk-pixbuf2, gdk-pixbuf2-devel, gdk-pixbuf2-modules (ALAS2023-2023-341)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-341 advisory. GNOME GdkPixbuf aka GDK-PixBuf before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c compositeframe. This overflow is...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-326)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-326 advisory. .NET and Visual Studio Remote Code Execution Vulnerability CVE-2023-35390 .NET Core and Visual Studio Denial of Service Vulnerability CVE-2023-38178 .NET and Visual Studio Denial of Service...

Amazon Linux 2023 : cni-plugins (ALAS2023-2023-338)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-338 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2023-324)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-324 advisory. In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities...

Amazon Linux 2023 : binutils, binutils-devel, binutils-gprofng (ALAS2023-2023-334)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-334 advisory. Heap buffer overflow vulnerability in binutils readelf before 2.40 via function displaydebugsection in file readelf.c. CVE-2022-45703 An issue was discovered in Binutils addr2line before 2.39.3...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2023-339)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-339 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2023-319)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-319 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authenticatio...

Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2023-340)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-340 advisory. An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an...

Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2023-331)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-331 advisory. A vulnerability in the filesystem image parser for Hierarchical File System Plus HFS+ of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-329)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-329 advisory. A NULL pointer dereference flaw was found in Libtiff's LZWDecode function in the libtiff/tiflzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-330)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-330 advisory. A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. CVE-2023-20588 The fix for XSA-423 added logic to Linux'es netback...

Amazon Linux 2023 : apache-ivy, apache-ivy-javadoc (ALAS2023-2023-336)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-336 advisory. Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior t...

Important: amazon-ecr-credential-helper

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: amazon-ecr-credential-helper Issue Correction: Run dnf update amazon-ecr-credential-helper --releasever 2023.1.20230906 or dnf update --advisory ALAS2023-2023-337 --releasever 2023.1.202309...

Medium: ImageMagick

Issue Overview: ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw. CVE-2023-39978 Affected Packages: ImageMagick Issue Correction: Run dnf update ImageMagick --releasever 2023.1.20230906 or dnf update --advisory ALAS2023-2023-320...