Important: freerdp

Issue Overview: FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using /parallel command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not...

Important: emacs

Issue Overview: GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags " command suggest...

Medium: vim

Issue Overview: Use After Free in GitHub repository vim/vim prior to 9.0.0882. CVE-2022-4292 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. CVE-2023-0049 Affected Packages: vim Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for...

Important: git

Issue Overview: Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository, which contains a set of file patterns and the attributes that should be set for path...

Medium: autotrace

Issue Overview: Heap-based buffer overflow in the pstoeditsuffixtableinit function in output-pstoedit.c in AutoTrace 0.31.1 allows remote attackers to cause a denial of service out-of-bounds write via a crafted bmp image file. CVE-2016-7392 A biWidthbiBitCnt integer overflow in input-bmp.c in...

Medium: golang

Issue Overview: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the...

Amazon Linux 2022 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2022-2023-281)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2023-281 advisory. Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens opportunities for DoS. CVE-2023-21835 Better Banking of Sounds: JARSoundbankReader can load...

Amazon Linux 2022 : bcel, bcel-javadoc (ALAS2022-2023-275)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-275 advisory. Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitra...

Amazon Linux 2022 : libsepol, libsepol-devel, libsepol-static (ALAS2022-2022-208)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-208 advisory. The CIL compiler in SELinux 3.2 has a use-after-free in cilverifyclassperms called from cilverifyclasspermission and cilpreverifyhelper. CVE-2021-36084 The CIL compiler in SELinux 3.2 has a...

Amazon Linux 2022 : lemon, sqlite, sqlite-analyzer (ALAS2022-2023-266)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-266 advisory. SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. CVE-2022-35737 Tenable has extracted the preceding...

Amazon Linux 2022 : cargo, clippy, rust (ALAS2022-2023-278)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-278 advisory. Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit...

Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2023-276)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2023-276 advisory. No description is available for this CVE. CVE-2022-43551 A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it supports through an HTTP proxy...

Amazon Linux 2022 : python3.10, python3.10-devel, python3.10-idle (ALAS2022-2023-274)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2023-274 advisory. Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non- default configuration. The Python multiprocessing library, when used with the forkserver...

Amazon Linux 2022 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2022-2023-272)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-272 advisory. Integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested f...

Amazon Linux 2022 : wireshark-cli, wireshark-devel (ALAS2022-2023-268)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-268 advisory. Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file CVE-2022-3725 Tenable has extracted the preceding description block...

Amazon Linux 2022 : bash, bash-devel (ALAS2022-2023-267)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-267 advisory. A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parametertransform. This issue may lead to memory problems. CVE-2022-3715 Tenable has extracted the preceding...

Amazon Linux 2022 : nginx, nginx-all-modules, nginx-core (ALAS2022-2023-270)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2023-270 advisory. NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the...

Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2023-269)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-269 advisory. The target's backtrace indicates that libc has detected a heap error or that the target was executing a heap function when it stopped. This could be due to heap corruption, passing a bad pointer to a he...

Amazon Linux 2022 : ctdb, libsmbclient, libsmbclient-devel (ALAS2022-2023-271)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-271 advisory. Integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested f...

Amazon Linux 2022 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2022-2023-279)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2023-279 advisory. Improve CORBA communication: CORBA deserialization can result in outbound network connections with data passed in. CVE-2023-21830 Better Banking of Sounds: JARSoundbankReader can load classes...