Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-243)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-243 advisory. A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cau...

Amazon Linux 2023 : python3-setuptools, python3-setuptools-wheel (ALAS2023-2023-245)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-245 advisory. Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2023-258)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-258 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-240)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-240 advisory. A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order,...

Amazon Linux 2023 : python3-tornado (ALAS2023-2023-239)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-239 advisory. Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2023-241)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-241 advisory. This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grants may extend it to oth...

Low: open-vm-tools

Issue Overview: A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. CVE-2023-20867 Affected Packages: open-vm-tools Issue Correction: Run dnf update open-vm-tools...

Low: python-configobj

Issue Overview: All versions of the package configobj are vulnerable to Regular Expression Denial of Service ReDoS via the validate function, using .+?\.\. Note: This is only exploitable in the case of a developer, putting the offending value in a server side configuration file. CVE-2023-26112...

Important: kernel-livepatch-6.1.29-47.49

Issue Overview: In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2022-48425 Affected Packages: kernel-livepatch-6.1.29-47.49 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-234)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-234 advisory. Reserved CVE CVE-2023-3269 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this issue but has instead relied...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-233)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-233 advisory. An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with certain traffic patterns. CVE-2023-1206 Tenable has extracted the preceding descriptio...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-228)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-228 advisory. In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF of alloc-vma in race with munmap CVE-2022-50240 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : json-c, json-c-devel (ALAS2023-2023-232)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-232 advisory. A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to...

Amazon Linux 2023 : ncurses, ncurses-base, ncurses-c++-libs (ALAS2023-2023-220)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-220 advisory. ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security- relevant memory corruption via malformed data in a terminfo database file that is found in...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-215)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-215 advisory. OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service DoS attack. A buffer...

Amazon Linux 2023 : glib2, glib2-devel, glib2-static (ALAS2023-2023-225)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-225 advisory. The upstream bug report describes this issue as follows: A vulnerability was found in GLib2.0, where DoS caused by handling a malicious text-form variant which is structured to cause looping...

Amazon Linux 2023 : libeconf, libeconf-devel, libeconf-utils (ALAS2023-2023-227)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-227 advisory. A Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in openSUSE libeconf leads to DoS via malformed config files.This issue affects libeconf: before 0.5.2...

Amazon Linux 2023 : dbus, dbus-common, dbus-daemon (ALAS2023-2023-213)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-213 advisory. D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor...

Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-214)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-214 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : opensmtpd (ALAS2023-2023-221)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-221 advisory. asciiloadsockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable through 7.0.0-portable, can abort upon a connection from a local, scoped IPv6 address...