Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-440)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-440 advisory. SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file CVE-2023-6174 A heap based buffer overflow in Wireshark's NetScreen file...

Amazon Linux 2023 : python3-cryptography (ALAS2023-2023-459)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-459 advisory. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.updateinto would accept Python objects which implement the buffer...

Amazon Linux 2023 : python3-cryptography (ALAS2023-2023-446)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-446 advisory. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling loadpempkcs7certificates or loadderpkcs7certificates could lead to a NULL-pointer...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-447)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-447 advisory. Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to b...

Medium: avahi

Issue Overview: A reachable assertion was found in avahirdataparse. CVE-2023-38472 Affected Packages: avahi Issue Correction: Run dnf update avahi --releasever 2023.3.20231211 or dnf update --advisory ALAS2023-2023-456 --releasever 2023.3.20231211 to update your system. More information on how to...

Medium: python-urllib3

Issue Overview: urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and...

Low: traceroute

Issue Overview: In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. CVE-2023-46316 Affected Packages: traceroute Issue Correction: Run dnf update traceroute --releasever 2023.3.20231211 or dnf update --advisory ALAS2023-2023-452 --releasev...

Medium: dotnet6.0

Issue Overview: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability CVE-2023-36049 ASP.NET Core - Security Feature Bypass Vulnerability CVE-2023-36558 Affected Packages: dotnet6.0 Issue Correction: Run dnf update dotnet6.0 --releasever 2023.3.20231211 or dnf update...

Medium: avahi

Issue Overview: A reachable assertion was found in avahialternativehostname. CVE-2023-38473 Affected Packages: avahi Issue Correction: Run dnf update avahi --releasever 2023.3.20231211 or dnf update --advisory ALAS2023-2023-455 --releasever 2023.3.20231211 to update your system. More information ...

Medium: python-cryptography

Issue Overview: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.updateinto would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects su...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2023-453)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-453 advisory. An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of...

Medium: python-pip

Issue Overview: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call ie "--config". Controlling the Mercurial configuration can modify how...

Low: shadow-utils

Issue Overview: A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve t...

Medium: jbig2dec

Issue Overview: Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2error at /jbig2dec/jbig2.c. CVE-2023-46361 Affected Packages: jbig2dec Issue Correction: Run dnf update jbig2dec --releasever 2023.3.20231211 or dnf update --advisory ALAS2023-2023-451...

Amazon Linux AMI : vim (ALAS-2023-1893)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1893 advisory. Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function gagrowinner in in the file src/alloc.c at line 748, which is freed in the file...

Amazon Linux AMI : kernel (ALAS-2023-1897)

The version of kernel installed on the remote host is prior to 4.14.330-176.540. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1897 advisory. 2024-06-19: CVE-2023-52845 was added to this advisory. A use-after-free flaw was found in vcsread in...

Amazon Linux AMI : samba (ALAS-2023-1896)

The version of samba installed on the remote host is prior to 4.10.16-24.68. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1896 advisory. When doing NTLM authentication, the client sends replies tocryptographic challenges back to the server. These repliesha...

Amazon Linux AMI : openssl (ALAS-2023-1891)

The version of openssl installed on the remote host is prior to 1.0.2k-16.165. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1891 advisory. Issue summary: Generating excessively long X9.42 DH keys or checkingexcessively long X9.42 DH keys or parameters may be very...

Amazon Linux AMI : xorg-x11-server (ALAS-2023-1892)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1892 advisory. A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration a multi-screen setup with multiple protocol screens, also known as Zaphod...

Amazon Linux AMI : libXpm (ALAS-2023-1894)

The version of libXpm installed on the remote host is prior to 3.5.10-2.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1894 advisory. libXpm: out of bounds read in XpmCreateXpmImageFromBuffer NOTE: https://www.openwall.com/lists/oss-security/2023/10/03/1NOTE: Fix...