Amazon Linux 2022 : cpp, gcc, gcc-c++ (ALAS2022-2022-057)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-057 advisory. A flaw was found in the way Unicode standards are implemented in the context of development environments, which have specialized requirements for rendering text. An attacker could exploit this to deceiv...

Amazon Linux 2022 : openssl1.1 (ALAS2022-2022-105)

The version of openssl1.1 installed on the remote host is prior to 1.1.1l-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-105 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed b...

Amazon Linux 2022 : openjpeg2, openjpeg2-devel, openjpeg2-tools (ALAS2022-2022-122)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-122 advisory. A flaw was found in the opj2decompress program in openjpeg2 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of t...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-125)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-125 advisory. A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. CVE-2022-2990...

Amazon Linux 2022 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2022-2022-130)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-130 advisory. A stack based buffer-overflow vulnerability was found in the deprecated compatibility function clntcreate in the sunrpc's clntgen.c module of the GNU C Library aka glibc through 2.34. This vulnerability...

Amazon Linux 2022 : flac, flac-devel, flac-libs (ALAS2022-2022-066)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-066 advisory. An out-of-bounds write vulnerability was found in libFlak. The vulnerability occurs due to a missing bounds check. This flaw allows a local attacker without additional execution privileges to cause loca...

Amazon Linux 2022 : httpd, httpd-core, httpd-devel (ALAS2022-2022-053)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-053 advisory. A flaw was found in the modlua module of httpd. A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function. The...

Amazon Linux 2022 : libinput, libinput-devel, libinput-test (ALAS2022-2022-092)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-092 advisory. A format string vulnerability was found in libinput CVE-2022-1215 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not teste...

Amazon Linux 2022 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2022-2022-119)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-119 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2022-2022-121)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-121 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : clamav, clamav-data, clamav-devel (ALAS2022-2022-063)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-063 advisory. A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial...

Amazon Linux 2022 : php, php-bcmath, php-cli (ALAS2022-2022-085)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-085 advisory. A flaw was found in PHP. The vulnerability occurs due to the malformed phpfilterfloat function and leads to a use-after-free vulnerability. This flaw allows an attacker to inject a malicious file, leadi...

Amazon Linux 2022 : cryptsetup, cryptsetup-devel, cryptsetup-libs (ALAS2022-2022-064)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-064 advisory. It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-039)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-039 advisory. Amazon Linux has been made aware of a potential Branch Target Injection BTI issue sometimes referred to as Spectre variant 2. This is a known cross-domain transient execution attack where a thi...

Amazon Linux 2022 : libxml2, libxml2-devel, libxml2-static (ALAS2022-2022-068)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-068 advisory. valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. CVE-2022-23308 A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the...

Amazon Linux 2022 : wireshark-cli, wireshark-devel (ALAS2022-2022-079)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-079 advisory. A NULL pointer exception flaw was found in Wireshark. A process failure on crafted or malformed input in the IPPUSB dissector can cause a denial of service via a packet injection or a crafted...

Amazon Linux 2022 : libsolv, libsolv-demo, libsolv-devel (ALAS2022-2022-093)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-093 advisory. A flaw was found in libsolv. A buffer overflow vulnerability could cause a denial of service. The highest threat from this vulnerability is to system availability. CVE-2021-3200 Tenable has extracted th...

Amazon Linux 2022 : zsh, zsh-html (ALAS2022-2022-117)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-117 advisory. A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code execution if they control a command output inside the prompt, as stated by ...

Amazon Linux 2022 : python3-lxml (ALAS2022-2022-074)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-074 advisory. There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using python-lxml's...

Amazon Linux 2022 : libblkid, libblkid-devel, libfdisk (ALAS2022-2022-099)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-099 advisory. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to...