Amazon Linux 2 : golang-github-gorilla-mux (ALAS-2022-1860)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1860 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2 : golang-googlecode-net (ALAS-2022-1861)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1861 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2022 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2022-2022-152)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-152 advisory. Title: Wider MultiByte conversionsBuffer overflow is possible due to incorrect byte count should be charactercount. CVE-2022-21618 Title: Improve NTLM supportwriteSecurityBuffer writes a...

Amazon Linux 2022 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2022-2022-151)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-151 advisory. Title: Wider MultiByte conversionsBuffer overflow is possible due to incorrect byte count should be charactercount. CVE-2022-21618 Title: Improve NTLM supportwriteSecurityBuffer writes a...

Amazon Linux 2022 : containerd, containerd-stress (ALAS2022-2022-156)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-156 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This...

Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-155)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-155 advisory. A use-after-free vulnerability was found in vim's docmdline function of the src/exdocmd.c file. The issue triggers when an invalid line number on :for is ignored. This flaw allows an attacker t...

Amazon Linux 2022 : freetype, freetype-demos, freetype-devel (ALAS2022-2022-154)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-154 advisory. A heap buffer overflow flaw was found in Freetype's sfntinitface function in the sfobjs.c file. The vulnerability occurs when creating a face with a strange file and invalid index. This flaw...

Denial Of Service (DoS)

libtiff.so amazon linux is vulnerable to denial of service. The vulnerability exists because an invalid range may be passed as an argument to the memset function within TIFFFetchStripThing of tifdirread.c which allows an attacker to cause an application crash passing a malicious TIFF file...

Amazon Linux 2 : containerd, docker (ALASDOCKER-2022-021)

The version of containerd installed on the remote host is prior to 1.6.6-1. The version of docker installed on the remote host is prior to 20.10.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2022-021 advisory. In net/http in Go before 1.18.6 and 1.19.x befor...

Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-145)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-145 advisory. A vulnerability was found in curl. This issue occurs because a malicious server can serve excessive amounts of Set-Cookie: headers in an HTTP response to curl, which stores all of them. This fl...

Amazon Linux 2 : runc (ALASDOCKER-2022-020)

The version of runc installed on the remote host is prior to 1.1.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2022-020 advisory. Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4...

Amazon Linux 2022 : lua, lua-devel, lua-libs (ALAS2022-2022-146)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-146 advisory. A heap buffer-overflow vulnerability was found in Lua. The flaw occurs due to vulnerable code present in the lparser.c function of Lua that allows the execution of untrusted Lua code into a...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-036 (ALASKERNEL-5.4-2022-036)

The version of kernel installed on the remote host is prior to 5.4.214-120.368. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-036 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Fr...

Amazon Linux 2022 : python3-subversion, subversion, subversion-devel (ALAS2022-2022-149)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-149 advisory. A flaw was found in Subversion. When using path-based authorization authz, the helper function detectchanged does not omit potentially sensitive information from log messages. In particular, if...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-150)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-150 advisory. A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root host user-level application to crash the host kernel by creating a confidential guest V...

Amazon Linux 2022 : rsync, rsync-daemon (ALAS2022-2022-148)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-148 advisory. A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitrary files in the client's rsync target...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-020 (ALASKERNEL-5.10-2022-020)

The version of kernel installed on the remote host is prior to 5.10.144-127.601. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-020 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2022-008 (ALASKERNEL-5.15-2022-008)

The version of kernel installed on the remote host is prior to 5.15.69-37.134. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-008 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Fr...

Amazon Linux 2022 : openssl, openssl-devel, openssl-libs (ALAS2022-2022-147)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-147 advisory. AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that...

Important: thunderbird

Issue Overview: A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers and the Mozilla Fuzzing Team reporting memory safety bugs in Firefox 102. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort...