Medium: libsndfile

Issue Overview: An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file via tricking a user to open or otherwise to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read...

Important: tar

Issue Overview: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in fromheader in list.c via a V7 archive in which mtime has approximate...

Low: vim

Issue Overview: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. CVE-2023-1127 Affected Packages: vim Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run...

Low: ghostscript

Issue Overview: Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. CVE-2019-25059 Affected Packages: ghostscript Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Medium: libxml2

Issue Overview: An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a...

Amazon Linux 2 : openssl11 (ALAS-2023-1974)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1974 advisory. AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the...

Amazon Linux 2 : libdb (ALAS-2023-1965)

The version of libdb installed on the remote host is prior to 5.3.21-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1965 advisory. Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges ...

Amazon Linux 2 : qt5-qtsvg (ALAS-2023-1968)

The version of qt5-qtsvg installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1968 advisory. Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend...

Amazon Linux 2 : cifs-utils, --advisory ALAS2-2023-1977 (ALAS-2023-1977)

The version of cifs-utils installed on the remote host is prior to 6.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1977 advisory. A flaw was found in cifs-utils. When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may...

Amazon Linux 2 : sudo (ALAS-2023-1985)

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1985 advisory. In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables...

Amazon Linux 2 : protobuf (ALAS-2023-1973)

The version of protobuf installed on the remote host is prior to 2.5.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1973 advisory. A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2,...

Amazon Linux 2 : curl (ALAS-2023-1986)

The version of curl installed on the remote host is prior to 7.88.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1986 advisory. A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the sam...

Amazon Linux 2 : cpio (ALAS-2023-1972)

The version of cpio installed on the remote host is prior to 2.12-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1972 advisory. GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer...

Amazon Linux 2 : batik (ALAS-2023-1966)

The version of batik installed on the remote host is prior to 1.8-0.12.svn1230816. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1966 advisory. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the...

Amazon Linux 2 : vim (ALAS-2023-1975)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1975 advisory. A heap buffer overflow vulnerability was found in vim's inscomplinfercasegettext function of the src/insexpand.c file. This flaw occurs when vim tries to access uninitialized memory when completi...

Amazon Linux 2 : thunderbird (ALAS-2023-1983)

The version of thunderbird installed on the remote host is prior to 102.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1983 advisory. 2024-02-15: CVE-2023-0616 was added to this advisory. If a MIME email combines OpenPGP and OpenPGP MIME data in a...

Amazon Linux 2 : emacs (ALAS-2023-1981)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1981 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, becau...

Amazon Linux 2 : freeradius (ALAS-2023-1970)

The version of freeradius installed on the remote host is prior to 3.0.26-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1970 advisory. The EAP-PWD function computepasswordelement leaks information about the password which allows an attacker to...

Amazon Linux 2 : python (ALAS-2023-1980)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1980 advisory. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing som...

Amazon Linux 2 : git (ALAS-2023-1984)

The version of git installed on the remote host is prior to 2.39.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1984 advisory. Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5,...