Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-055)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-055 advisory. 2024-06-06: CVE-2021-33117 was added to this advisory. Improper access control for some 3rd Generation IntelR XeonR Scalable Processors before BIOS version MR7, may allow a local attacker to...

Amazon Linux 2023 : less (ALAS2023-2023-123)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-123 advisory. 2024-02-29: CVE-2022-48624 was added to this advisory. In GNU Less before 609, crafted data can result in less -R not filtering ANSI escape sequences sent to the terminal. CVE-2022-46663...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-114)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-114 advisory. A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-064)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-064 advisory. A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an attacker with access to Redis to inject Lua code that executes the...

Amazon Linux 2023 : python3-twisted, python3-twisted+tls (ALAS2023-2023-130)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-130 advisory. Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResourc...

Amazon Linux 2023 : xdg-utils (ALAS2023-2023-007)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-007 advisory. A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2023-020)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-020 advisory. A flaw was found in grub 2, where a crafted 16-bit grayscale PNG image may lead to an out-of-bounds write. This flaw allows an attacker to corrupt the data on the heap portion of the grub2's...

Amazon Linux 2023 : libksba, libksba-devel (ALAS2023-2023-088)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-088 advisory. A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing speciall...

Amazon Linux 2023 : bcel, bcel-javadoc (ALAS2023-2023-105)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-105 advisory. Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitra...

Amazon Linux 2023 : lz4, lz4-devel, lz4-libs (ALAS2023-2023-015)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-015 advisory. There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove on a negative size argument,...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-132)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-132 advisory. It has been discovered that on some AMD CPUs, the RAS Return Address Stack, also called RAP - Return Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel...

Amazon Linux 2023 : libsndfile, libsndfile-devel, libsndfile-utils (ALAS2023-2023-028)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-028 advisory. An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file via tricking a user to open or otherwise to an application linke...

Amazon Linux 2023 : sysstat (ALAS2023-2023-094)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-094 advisory. sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocatestructures contains a sizet overflow in...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2023-104)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-104 advisory. Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non- default configuration. The Python multiprocessing library, when used with the forkserver...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-032)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-032 advisory. 2024-02-15: CVE-2016-2124 was added to this advisory. 2024-02-15: CVE-2021-44141 was added to this advisory. 2024-02-15: CVE-2021-20316 was added to this advisory. 2024-02-15: CVE-2020-17049 wa...

Amazon Linux 2023 : bsdcat, bsdcpio, bsdtar (ALAS2023-2023-071)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-071 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provid...

Amazon Linux 2023 : apr, apr-devel (ALAS2023-2023-016)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-016 advisory. An out-of-bounds array read in the aprtimeexp functions was fixed in the Apache Portable Runtime 1.6.3 release CVE-2017-12613. The fix for this issue was not carried forward to the APR 1.7.x...

Amazon Linux 2023 : libdwarf, libdwarf-devel, libdwarf-static (ALAS2023-2023-093)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-093 advisory. A double-free vulnerability was found in libdwarf's dwarfexpandframeinstructions function of the dwarfframe.c file. A carefully crafted object file could cause the 'dwarfdump' utility to do a double fre...

Amazon Linux 2023 : systemd, systemd-container, systemd-devel (ALAS2023-2023-025)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-025 advisory. A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. CVE-2021-3997 A...

Amazon Linux 2023 : fribidi, fribidi-devel (ALAS2023-2023-069)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-069 advisory. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory...