CVE-2022-34266

The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service application crash, a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset function within...

CVE-2022-34266

The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service application crash, a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset function within...

CVE-2022-34266

The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service application crash, a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset function within...

Code injection

The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service application crash, a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset function within...

CVE-2022-34266

The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service application crash, a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset function within...

CVE-2022-34266

LibTIFF (libtiff) is affected by CVE-2022-34266 and related CVEs in the same family. CVE-2022-34266 arises when processing a crafted TIFF file: an invalid range passed to memset() in TIFFFetchStripThing() (tif_dirread.c) can cause a segfault after using an uninitialized resource, leading to a cra...

CVE-2022-34266

The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service application crash, a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset function within...

Medium: openssl11

Issue Overview: The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the...

Amazon Linux 2 : httpd (ALAS-2022-1812)

The version of httpd installed on the remote host is prior to 2.4.54-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1812 advisory. An HTTP request smuggling vulnerability was found in the modproxyajp module of httpd. This flaw allows an attacker to smugg...

Medium: curl

Issue Overview: A vulnerability was found in curl. This issue occurs because curl can reuse a previously created connection even when a TLS or SSH-related option is changed that should have prohibited reuse. This flaw leads to an authentication bypass, either by mistake or by a malicious actor...

Amazon Linux 2 : golang (ALAS-2022-1811)

The version of golang installed on the remote host is prior to 1.16.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1811 advisory. An infinite loop vulnerability was found in golang. If an application defines a custom token parser initializing with...

Amazon Linux 2 : rust (ALAS-2022-1816)

The version of rust installed on the remote host is prior to 1.56.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1816 advisory. In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized byt...

Amazon Linux 2 : thunderbird (ALAS-2022-1818)

The version of thunderbird installed on the remote host is prior to 91.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1818 advisory. crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versio...

Medium: amazon-ssm-agent

Issue Overview: A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM input more than 5 MB , causing a stack overflow in Decode, which leads to a loss of availability. CVE-2022-24675 Affected Packages: amazon-ssm-agent Note: This adviso...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2022-1807)

The version of amazon-ssm-agent installed on the remote host is prior to 3.1.1575.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1807 advisory. A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM...

Amazon Linux 2 : libtiff (ALAS-2022-1814)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1814 advisory. A flaw was found in libtiff where a NULL source pointer passed as an argument to the memcpy function within the...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1813 (ALAS-2022-1813)

The version of kernel installed on the remote host is prior to 4.14.285-215.501. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1813 advisory. A kernel information leak flaw was identified in the scsiioctl function in drivers/scsi/scsiioctl.c in the Linux...

Amazon Linux 2 : expat (ALAS-2022-1809)

The version of expat installed on the remote host is prior to 2.1.0-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1809 advisory. In doProlog in xmlparse.c in Expat aka libexpat before 2.4.3, an integer overflow exists for mgroupSize. CVE-2021-46143...

Amazon Linux 2 : openssl11 (ALAS-2022-1815)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1815 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by...

Amazon Linux 2 : curl (ALAS-2022-1808)

The version of curl installed on the remote host is prior to 7.79.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1808 advisory. A vulnerability was found in curl. This issue occurs because curl can reuse a previously created connection even when a TLS or...