Important: kernel

Issue Overview: An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with certain traffic patterns. CVE-2023-1206 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn...

Important: kernel

Issue Overview: An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with certain traffic patterns. CVE-2023-1206 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn mo...

Important: kernel-livepatch-4.14.314-238.539

Issue Overview: dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference. CVE-2023-28466 Affected Packages: kernel-livepatch-4.14.314-238.539 Issue Correction: Please ensur...

Important: kernel-livepatch-4.14.314-237.533

Issue Overview: dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference. CVE-2023-28466 Affected Packages: kernel-livepatch-4.14.314-237.533 Issue Correction: Please ensur...

Important: kernel

Issue Overview: An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with certain traffic patterns. CVE-2023-1206 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for...

Amazon Linux 2023 : screen (ALAS2023-2023-224)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-224 advisory. socket.c in GNU Screen through 4.9.0, when installed setuid or setgid the default on platforms such as Arch Linux and FreeBSD, allows local users to send a privileged SIGHUP signal to any PID, causing a...

Amazon Linux 2023 : binutils, binutils-devel, binutils-gprofng (ALAS2023-2023-229)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-229 advisory. Potential heap based buffer overflow found in bfdelfslurpversiontables in bfd/elf.c. CVE-2023-1972 Tenable has extracted the preceding description block directly from the tested product security advisor...

Amazon Linux 2023 : runc (ALAS2023-2023-231)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-231 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : glib2, glib2-devel, glib2-static (ALAS2023-2023-225)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-225 advisory. The upstream bug report describes this issue as follows: A vulnerability was found in GLib2.0, where DoS caused by handling a malicious text-form variant which is structured to cause looping...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-215)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-215 advisory. OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service DoS attack. A buffer...

Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2023-223)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-223 advisory. A vulnerability was found in cups-filters. This security flaw occurs if you use beh to create an accessible network printer, possibly resulting in remote code execution. CVE-2023-24805 Tenable has...

Amazon Linux 2023 : ncurses, ncurses-base, ncurses-c++-libs (ALAS2023-2023-220)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-220 advisory. ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security- relevant memory corruption via malformed data in a terminfo database file that is found in...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-222)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-222 advisory. Issue summary: Processing some specially crafted ASN.1 object identifiers ordata containing them may be very slow. Impact summary: Applications that use OBJobj2txt directly, or use any ofthe OpenSSL...

Amazon Linux 2023 : perl-Pod-Perldoc (ALAS2023-2023-217)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-217 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31486 Tenable has...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-230)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-230 advisory. LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, th...

Amazon Linux 2023 : dbus, dbus-common, dbus-daemon (ALAS2023-2023-213)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-213 advisory. D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor...

Amazon Linux 2023 : libeconf, libeconf-devel, libeconf-utils (ALAS2023-2023-227)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-227 advisory. A Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in openSUSE libeconf leads to DoS via malformed config files.This issue affects libeconf: before 0.5.2...

Amazon Linux 2023 : openldap, openldap-clients, openldap-compat (ALAS2023-2023-219)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-219 advisory. A vulnerability was found in openldap that can cause a null pointer dereference in the bermemallocx function. CVE-2023-2953 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2023 : perl-HTTP-Tiny, perl-HTTP-Tiny-tests (ALAS2023-2023-216)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-216 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31486 Tenable has...

Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-214)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-214 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...