Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2023-052)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-052 advisory. A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2023-115)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-115 advisory. A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location beyond the header value sent. This could cause the process to cras...

Amazon Linux 2023 : openjpeg2, openjpeg2-devel, openjpeg2-tools (ALAS2023-2023-040)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-040 advisory. There is a flaw in the opj2compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2compress, could trigger a heap...

Amazon Linux 2023 : gzip (ALAS2023-2023-043)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-043 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's...

Amazon Linux 2023 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2023-2023-087)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-087 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2023-102)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-102 advisory. A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the SProcRenderCompositeGlyphs function due to improper validation of the request length. CVE-2021-4008 A fla...

Amazon Linux 2023 : python3-subversion, subversion, subversion-devel (ALAS2023-2023-011)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-011 advisory. A flaw was found in Subversion. When using path-based authorization authz, the helper function detectchanged does not omit potentially sensitive information from log messages. In particular, if...

Amazon Linux 2023 : libsolv, libsolv-demo, libsolv-devel (ALAS2023-2023-013)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-013 advisory. A flaw was found in libsolv. A buffer overflow vulnerability could cause a denial of service. The highest threat from this vulnerability is to system availability. CVE-2021-3200 Tenable has extracted th...

Amazon Linux 2023 : tpm2-tss, tpm2-tss-devel (ALAS2023-2023-110)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-110 advisory. tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Stack TSS2. In affected versions Tss2RCSetHandler and Tss2RCDecode both index...

Amazon Linux 2023 : python3-lxml (ALAS2023-2023-034)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-034 advisory. There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using...

Amazon Linux 2023 : cpp, gcc, gcc-c++ (ALAS2023-2023-030)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-030 advisory. A flaw was found in the way Unicode standards are implemented in the context of development environments, which have specialized requirements for rendering text. An attacker could exploit this to deceiv...

Amazon Linux 2023 : libksba, libksba-devel (ALAS2023-2023-088)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-088 advisory. A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing speciall...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-067)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-067 advisory. There is a double free or corruption in rotateImage at tiffcrop.c:8839 found in libtiff 4.4.0rc1. CVE-2022-2519 A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in...

Amazon Linux 2023 : python3-twisted, python3-twisted+tls (ALAS2023-2023-056)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-056 advisory. A flaw was found in the twisted Python library when WebClient redirects via the RedirectAgent and BrowserLikeRedirectAgent methods. This flaw allows an attacker to take advantage of these...

Amazon Linux 2023 : freetype, freetype-demos, freetype-devel (ALAS2023-2023-074)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-074 advisory. A heap buffer overflow leading to out-of-bounds write was found in freetype. Memory allocation based on truncated PNG width and height values allows for an out-of-bounds write to occur in...

Amazon Linux 2023 : maven-shared-utils, maven-shared-utils-javadoc (ALAS2023-2023-077)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-077 advisory. org.apache.maven.shared:maven-shared-utils is a functional replacement for plexus-utils in Maven. Affected versions of this package are vulnerable to Command Injection. The Commandline class can emit...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-122)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-122 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2023-078)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-078 advisory. NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by targeting an Unbound instance. Unbound is queri...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2023-031)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-031 advisory. NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within...

Amazon Linux 2023 : aws-nitro-enclaves-cli, aws-nitro-enclaves-cli-devel, aws-nitro-enclaves-cli-integration-tests (ALAS2023-2023-129)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-129 advisory. Hyperium Hyper before 0.14.19 does not allow for customization of the maxheaderlistsize method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. CVE-2022-31394 Tenable has...