Amazon Linux 2022 : libinput, libinput-devel, libinput-test (ALAS2022-2022-186)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-186 advisory. A format string vulnerability was found in libinput CVE-2022-1215 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not teste...

Amazon Linux 2022 : fribidi, fribidi-devel (ALAS2022-2022-200)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-200 advisory. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory...

Amazon Linux 2022 : protobuf, protobuf-compiler, protobuf-devel (ALAS2022-2022-165)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-165 advisory. A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute...

Amazon Linux 2022 : rsync, rsync-daemon (ALAS2022-2022-158)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-158 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large numbe...

Amazon Linux 2022 : zziplib, zziplib-devel, zziplib-utils (ALAS2022-2022-162)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-162 advisory. Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value zzipfileread in the function unzzipcatfile. CVE-2020-18442 Tenable has extracted the preceding...

Amazon Linux 2022 : cryptsetup, cryptsetup-devel, cryptsetup-libs (ALAS2022-2022-174)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-174 advisory. It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk...

Amazon Linux 2022 : bsdcat, bsdcpio, bsdtar (ALAS2022-2022-201)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-201 advisory. An out-of-bounds read flaw was found in libarchive. This flaw allows an attacker who can supply a specially crafted zip file to libarchive to cause an out-of-bounds read in programs linked with...

Amazon Linux 2022 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2022-2022-204)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-204 advisory. A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local attackers gaining root privileges. CVE-2022-27239 A flaw was found...

Amazon Linux 2022 : autotrace, autotrace-devel (ALAS2022-2022-160)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-160 advisory. A biWidthbiBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap image. CVE-2019-19004 A bitmap doubl...

Amazon Linux 2022 : lua, lua-devel, lua-libs (ALAS2022-2022-176)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-176 advisory. A stack overflow issue was discovered in Lua in the luaresume function of ldo.c. This flaw allows a local attacker to pass a specially crafted file to the Lua Interpreter, causing a crash that...

Amazon Linux 2022 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2022-2022-207)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-207 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control...

Amazon Linux 2022 : logrotate (ALAS2022-2022-189)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-189 advisory. A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock...

Amazon Linux 2022 : lz4, lz4-devel, lz4-libs (ALAS2022-2022-169)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-169 advisory. There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove on a negative size argument,...

Amazon Linux 2022 : libsepol, libsepol-devel, libsepol-static (ALAS2022-2022-170)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-170 advisory. The CIL compiler in SELinux 3.2 has a use-after-free in cilverifyclassperms called from cilverifyclasspermission and cilpreverifyhelper. CVE-2021-36084 The CIL compiler in SELinux 3.2 has a...

Amazon Linux 2022 : python3-lxml (ALAS2022-2022-178)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-178 advisory. There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using python-lxml's...

Amazon Linux 2022 : python3-bottle (ALAS2022-2022-205)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-205 advisory. Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. CVE-2022-3179 Bottle before 0.12.20 mishandles errors during early request binding. CVE-2022-31799 Tenable has...

Amazon Linux 2022 : golist (ALAS2022-2022-192)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-192 advisory. A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating chunked encoding. This issue could allow request smuggling, but only if combined with an...

Amazon Linux 2022 : httpd, httpd-core, httpd-devel (ALAS2022-2022-202)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-202 advisory. An HTTP request smuggling vulnerability was found in the modproxyajp module of httpd. This flaw allows an attacker to smuggle requests to the AJP server, where it forwards requests...

Amazon Linux 2022 : xz, xz-devel, xz-libs (ALAS2022-2022-187)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-187 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's...

Amazon Linux 2022 : perl-CPAN, perl-CPAN-tests (ALAS2022-2022-161)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-161 advisory. A flaw was found in the way the perl-CPAN performed verification of package signatures stored in CHECKSUMS files. A malicious or compromised CPAN server used by a user, or a man-in-the-middle attacker,...