Important: kernel

Issue Overview: A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in tableclear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component. CVE-2023-2269 In the Linux kernel through 6.3.1, a use-after-free in...

Important: kernel

Issue Overview: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are...

Important: runc

Issue Overview: runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes /sys/fs/cgroup writable in following conditons: 1. when runc is executed inside the user namespace, and the config.json does not...

Medium: tar

Issue Overview: paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers. CVE-2019-9923 Affected Packages: tar Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ sectio...

Medium: apache-commons-io

Issue Overview: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus...

Important: kernel-livepatch-5.10.178-162.673

Issue Overview: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are...

Important: thunderbird

Issue Overview: In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. CVE-2023-32205 The Mozilla Foundation Security Advisory describes this flaw as: An out-of-bound read could have led to...

Important: runc

Issue Overview: runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes /sys/fs/cgroup writable in following conditons: 1. when runc is executed inside the user namespace, and the config.json does not...

Amazon Linux 2022 : golang, golang-bin, golang-misc (ALAS2022-2022-128)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-128 advisory. A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating chunked encoding. This issue could allow request smuggling, but only if combined with an...

Amazon Linux AMI : kernel (ALAS-2023-1744)

The version of kernel installed on the remote host is prior to 4.14.314-164.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1744 advisory. A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inod...

Amazon Linux AMI : tigervnc (ALAS-2023-1746)

The version of tigervnc installed on the remote host is prior to 1.8.0-21.35. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1746 advisory. A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-179)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-179 advisory. qfqchangeclass in net/sched/schqfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQMINLMAX. CVE-2023-31436 Tenable has extracted the preceding description...

Amazon Linux AMI : samba (ALAS-2023-1747)

The version of samba installed on the remote host is prior to 4.10.16-24.66. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1747 advisory. Netlogon RPC Elevation of Privilege Vulnerability. CVE-2022-38023 Tenable has extracted the preceding description block directly...

Amazon Linux AMI : ImageMagick (ALAS-2023-1745)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1745 advisory. A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation...

Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2023-178)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-178 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Tenable has...

Amazon Linux AMI : libwebp (ALAS-2023-1748)

The version of libwebp installed on the remote host is prior to 0.3.0-10.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1748 advisory. A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes. CVE-2018-25013 Tenable has extracted th...

Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2023-180)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-180 advisory. Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-181)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-181 advisory. A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able ...

Amazon Linux AMI : glib2 (ALAS-2023-1749)

The version of glib2 installed on the remote host is prior to 2.36.3-5.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1749 advisory. GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in gmarkupparsecontextparse in gmarkup.c, related to utf8str...

Amazon Linux 2 : kernel (ALAS-2023-2035)

The version of kernel installed on the remote host is prior to 4.14.314-237.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2035 advisory. A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra ino...