Important: python3.11

Issue Overview: There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives. CVE-2024-6232 Affected Packages: python3.11 Issue Correction: Ru...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2024-759)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-759 advisory. libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case of a large token for which multiple buffer fills are needed...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-765)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-765 advisory. 2024-12-05: CVE-2023-52751 was added to this advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2queryinfocompound CVE-2023-5275...

Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2024-762)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-762 advisory. python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : python3-idna (ALAS2023-2024-763)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-763 advisory. python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-760)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-760 advisory. unbound: NULL Pointer Dereference in Unbound CVE-2024-43167 unbound: Heap-Buffer-Overflow in Unbound CVE-2024-43168 Tenable has extracted the preceding description block directly from the teste...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2024-766)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-766 advisory. node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders c...

Medium: python-pillow

Issue Overview: In imagingcms.c, two strcpy calls were able to copy too much data into fixed length strings. This has been fixed by using strncpy instead. CVE-2024-28219 Affected Packages: python-pillow Issue Correction: Run dnf update python-pillow --releasever 2023.6.20241111 or dnf update...

Medium: python-idna

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-idna Issue Correction: Run dnf update python-idna --releasever 2023.6.20241111 or dnf update --advisory ALAS2023-2024-763 --releasever...

Medium: python-pip

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-pip Issue Correction: Run dnf update python-pip --releasever 2023.6.20241111 to update your system. New Packages: noarch: ...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2024-761)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-761 advisory. Vim is an open source command line text editor. Vim v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2024-767)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-767 advisory. In imagingcms.c, two strcpy calls were able to copy too much data into fixed length strings. This has been fixed by using strncpy instead. CVE-2024-28219 Tenable has extracted the preceding description...

Medium: python-pillow

Issue Overview: In imagingcms.c, two strcpy calls were able to copy too much data into fixed length strings. This has been fixed by using strncpy instead. CVE-2024-28219 Affected Packages: python-pillow Issue Correction: Run dnf update python-pillow --releasever 2023.6.20241111 to update your...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2024-757)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-757 advisory. There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted...

Important: python3.11

Issue Overview: There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives. CVE-2024-6232 Affected Packages: python3.11 Issue Correction: Ru...

Medium: python-pip

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-pip Issue Correction: Run dnf update python-pip --releasever 2023.6.20241111 or dnf update --advisory ALAS2023-2024-764 --releasever...

Medium: python3.11-pip

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python3.11-pip Issue Correction: Run dnf update python3.11-pip --releasever 2023.6.20241111 or dnf update --advisory ALAS2023-2024-762 --releasever...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2024-764)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-764 advisory. python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2024-756)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-756 advisory. A flaw was found in the X.org server. Due to improperly tracked allocation size in XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload,...

Important: firefox

Issue Overview: A permission leak could have occurred from a trusted site to an untrusted site via embed or object elements. This vulnerability affects Firefox 132, Firefox ESR 128.4, Firefox ESR 115.17, Thunderbird 128.4, and Thunderbird 132. CVE-2024-10458 An attacker could have caused a...