Amazon Linux 2023 : composer (ALAS2023-2023-384)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-384 advisory. Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code executi...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2023-395)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-395 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Amazon Linux 2023 : libX11, libX11-common, libX11-devel (ALAS2023-2023-383)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-383 advisory. libX11: out-of-bounds memory access in XkbReadKeySyms CVE-2023-43785 A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user t...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2023-388)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-388 advisory. The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. CVE-2021-43565 A broken cryptographic algorithm flaw was foun...

Amazon Linux 2023 : libXpm, libXpm-devel (ALAS2023-2023-382)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-382 advisory. A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to consume all available system resources and cause a denial of servic...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2023-387)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-387 advisory. 2024-02-29: CVE-2022-41862 was added to this advisory. In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryptio...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2023-401)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-401 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 20.0.2...

Important: kernel-livepatch-6.1.25-37.47

Issue Overview: A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue results from the improper handling of user-supplied data, which can lead to an assertion failure. This flaw allows an unauthenticated, remote attacker to create a denial of...

Important: kernel-livepatch-6.1.29-50.88

Issue Overview: A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local privilege escalation. If tcfchangeindev fails, u32setparms will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-390)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-390 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2023-393)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-393 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-394)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-394 advisory. Line directives //line can be used to bypass the restrictions on //go:cgo directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-389)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-389 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-391)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-391 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-377)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-377 advisory. An issue was found in curl that can cause a buffer overflow in its SOCKS5 proxy communications code. When curl is using a SOCKS5 proxy and it needs to resolve a hostname to an IP address, its...

Amazon Linux 2023 : pmix, pmix-devel, pmix-pmi (ALAS2023-2023-363)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-363 advisory. OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0. CVE-2023-41915 Tenable has...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-356)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-356 advisory. An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in readdescriptors in drivers/usb/core/sysfs.c. CVE-2023-37453 nftables...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-361)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-361 advisory. A vulnerability was found in OpenPrinting CUPS. The security flaw occurs due to failure in validating the length provided by an attacker-crafted CUPS document, possibly leading to a heap-based buffer...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-367)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-367 advisory. The html/template package does not properly handle HTML-like comment tokens, nor hashbang ! comment tokens, in contexts. This may cause the template parser to improperly interpret the contents ...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-364)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-364 advisory. LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that...