Amazon Linux 2 : pcs (ALAS-2023-1905)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1905 advisory. A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects...

Important: kernel-livepatch-5.10.155-138.670

Issue Overview: A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function followpagepte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remotely. It is recommended ...

Important: kernel-livepatch-4.14.299-223.520

Issue Overview: A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6renewoptions of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a...

Amazon Linux 2 : golist (ALAS-2023-1913)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1913 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to...

Amazon Linux 2 : libtasn1 (ALAS-2023-1908)

The version of libtasn1 installed on the remote host is prior to 4.10-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1908 advisory. GNU Libtasn1 before 4.19.0 has an ETYPEOK off-by-one array size check that affects asn1encodesimpleder. CVE-2021-46848 Tenable has...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2023-1919)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.6+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1919 advisory. Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens...

Amazon Linux 2 : freetype (ALAS-2023-1909)

The version of freetype installed on the remote host is prior to 2.8-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1909 advisory. A heap buffer overflow flaw was found in Freetype's sfntinitface function in the sfobjs.c file. The vulnerability occurs...

Amazon Linux 2 : xorg-x11-server (ALAS-2023-1910)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1910 advisory. A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow...

Amazon Linux 2 : vim (ALAS-2023-1912)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1912 advisory. The target's backtrace indicates that libc has detected a heap error or that the target was executing a heap function when it stopped. This could be due to heap corruption, passing a bad pointer to a heap...

Amazon Linux 2 : sqlite (ALAS-2023-1911)

The version of sqlite installed on the remote host is prior to 3.7.17-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1911 advisory. SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string...

Medium: java-11-amazon-corretto

Issue Overview: Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens opportunities for DoS. CVE-2023-21835 Better Banking of Sounds: JARSoundbankReader can load classes from remote URLs. CVE-2023-21843 Affected Packages: java-11-amazon-corretto Note:...

Medium: pcs

Issue Overview: A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data...

Medium: java-17-amazon-corretto

Issue Overview: Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens opportunities for DoS. CVE-2023-21835 Better Banking of Sounds: JARSoundbankReader can load classes from remote URLs. CVE-2023-21843 Affected Packages: java-17-amazon-corretto Note:...

Important: xorg-x11-server

Issue Overview: A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of th...

Important: bcel

Issue Overview: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllab...

Important: libtasn1

Issue Overview: GNU Libtasn1 before 4.19.0 has an ETYPEOK off-by-one array size check that affects asn1encodesimpleder. CVE-2021-46848 Affected Packages: libtasn1 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core an...

Important: sqlite

Issue Overview: SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. CVE-2022-35737 Affected Packages: sqlite Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

Important: golist

Issue Overview: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...

Amazon Linux 2 : python (ALAS-2021-1669)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1669 advisory. A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively do not...

Amazon Linux 2 : python3 (ALAS-2021-1670)

The version of python3 installed on the remote host is prior to 3.7.10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1670 advisory. A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively ...