Amazon Linux 2022 : vsftpd (ALAS2022-2022-172)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-172 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates...

Amazon Linux 2022 : cups, cups-client, cups-devel (ALAS2022-2022-203)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-203 advisory. An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as...

Amazon Linux 2022 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2022-2022-196)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-196 advisory. A flaw was found in python-pillow. The vulnerability occurs due to improper initialization of image paths, leading to a buffer over-read and improper initialization. This flaw allows an attacke...

Amazon Linux 2022 : bind, bind-chroot, bind-devel (ALAS2022-2022-166)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-166 advisory. A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This...

Amazon Linux 2022 : libtiff, libtiff-devel, libtiff-static (ALAS2022-2022-183)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-183 advisory. Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available wi...

Amazon Linux 2022 : postgresql14, postgresql14-contrib, postgresql14-llvmjit (ALAS2022-2022-190)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-190 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH...

Amazon Linux 2022 : harfbuzz, harfbuzz-devel, harfbuzz-icu (ALAS2022-2022-181)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-181 advisory. HarfBuzz 2.9.0 has an out-of-bounds write in hbbitsetinvertiblet::set called from hbsparsesett::set and hbsetcopy. CVE-2021-45931 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2022 : minizip-compat, minizip-compat-devel, zlib (ALAS2022-2022-159)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-159 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large number of...

Amazon Linux 2022 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2022-2022-182)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-182 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability...

Amazon Linux 2022 : zsh, zsh-html (ALAS2022-2022-180)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-180 advisory. A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code execution if they control a command output inside the prompt, as stated by ...

Amazon Linux 2022 : protobuf, protobuf-compiler, protobuf-devel (ALAS2022-2022-165)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-165 advisory. A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute...

Amazon Linux 2022 : libsolv, libsolv-demo, libsolv-devel (ALAS2022-2022-167)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-167 advisory. A flaw was found in libsolv. A buffer overflow vulnerability could cause a denial of service. The highest threat from this vulnerability is to system availability. CVE-2021-3200 Tenable has extracted th...

Amazon Linux 2022 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2022-2022-197)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-197 advisory. A stack based buffer-overflow vulnerability was found in the deprecated compatibility function clntcreate in the sunrpc's clntgen.c module of the GNU C Library aka glibc through 2.34. This vulnerability...

Amazon Linux 2022 : fribidi, fribidi-devel (ALAS2022-2022-200)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-200 advisory. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory...

Amazon Linux 2022 : sendmail, sendmail-cf, sendmail-milter (ALAS2022-2022-171)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-171 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates...

Amazon Linux 2022 : gzip (ALAS2022-2022-188)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-188 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's...

Amazon Linux 2022 : libinput, libinput-devel, libinput-test (ALAS2022-2022-186)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-186 advisory. A format string vulnerability was found in libinput CVE-2022-1215 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not teste...

Amazon Linux 2022 : golang, golang-bin, golang-misc (ALAS2022-2022-193)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-193 advisory. A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating chunked encoding. This issue could allow request smuggling, but only if combined with an...

Amazon Linux 2022 : autotrace, autotrace-devel (ALAS2022-2022-160)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-160 advisory. A biWidthbiBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap image. CVE-2019-19004 A bitmap doubl...

Amazon Linux 2022 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2022-2022-207)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-207 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control...