Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2024-781)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-781 advisory. Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-784)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-784 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow timeout for anonymous sets CVE-2023-52620 In the Linux kernel, the following vulnerability has...

Amazon Linux 2022 : ctdb, ctdb-pcp-pmda, libsmbclient (ALAS2022-2022-022)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-022 advisory. A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was...

Amazon Linux 2023 : apr, apr-devel (ALAS2023-2024-789)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-789 advisory. Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2024-777)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-777 advisory. .NET and Visual Studio Remote Code Execution Vulnerability CVE-2024-38229 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024-43483 .NET, .NET Framework, and Visual...

Amazon Linux 2022 : webkit2gtk3, webkit2gtk3-devel, webkit2gtk3-jsc (ALAS2022-2022-015)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-015 advisory. A use-after-free flaw was found in WebKitGTK. Specially crafted web content could use this flaw to trigger an arbitrary code execution when processed. CVE-2021-30809 A confusion type flaw was...

Amazon Linux 2022 : qt, qt-assistant, qt-common (ALAS2022-2021-006)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2021-006 advisory. Qt5 versions up to qt 5.12.7, qt 5.14.1, qt 5.15.0 allows plugins to be loaded from current working directory, this can lead to compromised plugins to loaded leading to possible arbitrary code execution...

Amazon Linux 2022 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2022-2022-012)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-012 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable vulnerability allows high...

Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-020)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-020 advisory. A flaw was found in vim. The vulnerability occurs due to not checking the length for the NameBuff function, which can lead to a heap buffer overflow. This flaw allows an attacker to input a...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-024)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-024 advisory. A heap-based buffer overflow flaw was found in the way the legacyparseparam function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An...

Amazon Linux 2022 : zsh, zsh-html (ALAS2022-2022-034)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-034 advisory. A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code execution if they control a command output inside the prompt, as stated by ...

Amazon Linux 2022 : jdom, jdom-demo, jdom-javadoc (ALAS2022-2022-010)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-010 advisory. An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. CVE-2021-33813 Tenable has extracted the preceding description block directly...

Amazon Linux 2023 : opensc (ALAS2023-2024-775)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-775 advisory. It is caused by the libopensc library in opensc porject. This vulnerability affects how the buffer data is handled and partially filled buffers can be accessed incorrectly when a specially...

Amazon Linux 2022 : harfbuzz, harfbuzz-devel, harfbuzz-icu (ALAS2022-2022-027)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-027 advisory. HarfBuzz 2.9.0 has an out-of-bounds write in hbbitsetinvertiblet::set called from hbsparsesett::set and hbsetcopy. CVE-2021-45931 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2023 : python3-requests, python3-requests+security, python3-requests+socks (ALAS2023-2024-782)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-782 advisory. Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the...

Amazon Linux 2022 : golang, golang-bin, golang-misc (ALAS2022-2021-007)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2021-007 advisory. A validation flaw was found in golang. When invoking functions from WASM modules built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten...

Amazon Linux 2022 : httpd, httpd-devel, httpd-filesystem (ALAS2022-2022-018)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-018 advisory. There's a null pointer dereference and server-side request forgery flaw in httpd's modproxy module, when it is configured to be used as a forward proxy. A crafted packet could be sent on the...

Amazon Linux 2022 : log4j, log4j-jcl, log4j-slf4j (ALAS2022-2021-004)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2021-004 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with control over Thread Context Map MDC inp...

Amazon Linux : Enabled Official Repositories and Extras

The remote host is using one or more Amazon Linux repositories to install packages. These repositories may be used in conjuntion with Amazon Linux OS package level assessment security advisories to determine whether or not relevant repositories are installed before checking package versions for...

Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-lusitaniae-apacheexporter was updated from version 1.0.1 to 1.0.8: Security issues fixed: CVE-2023-3978: Fixed security bug in x/net dependency in version 1.0.2 bsc1213933 Bugs fixed: Require Go 1.20 when building for RedHat derivatives Versio...