Amazon Linux 2 : curl, libcurl, libcurl-devel (ALAS-2023-1924)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1924 advisory. A vulnerability was found in curl. This issue occurs due to an erroneous function. A malicious server could make curl within Network Security Services NSS get stuck in a never-ending busy loop wh...

Amazon Linux AMI : emacs-git, emacs-git-el, git (ALAS-2023-1679)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1679 advisory. Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository,...

Amazon Linux AMI : sudo, sudo-devel (ALAS-2023-1682)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1682 advisory. In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append...

Medium: vim

Issue Overview: Use After Free in GitHub repository vim/vim prior to 9.0.0882. CVE-2022-4292 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. CVE-2023-0049 Affected Packages: vim Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for...

Medium: golang

Issue Overview: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the...

Important: emacs

Issue Overview: GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags " command suggest...

Medium: autotrace

Issue Overview: Heap-based buffer overflow in the pstoeditsuffixtableinit function in output-pstoedit.c in AutoTrace 0.31.1 allows remote attackers to cause a denial of service out-of-bounds write via a crafted bmp image file. CVE-2016-7392 A biWidthbiBitCnt integer overflow in input-bmp.c in...

Low: util-linux

Issue Overview: DISPUTED An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and...

Important: freerdp

Issue Overview: FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using /parallel command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not...

Important: git

Issue Overview: Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository, which contains a set of file patterns and the attributes that should be set for path...

Amazon Linux 2022 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2022-2023-281)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2023-281 advisory. Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens opportunities for DoS. CVE-2023-21835 Better Banking of Sounds: JARSoundbankReader can load...

Amazon Linux 2022 : containerd, containerd-stress (ALAS2022-2022-210)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-210 advisory. A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary...

Amazon Linux 2022 : lemon, sqlite, sqlite-analyzer (ALAS2022-2023-266)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-266 advisory. SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. CVE-2022-35737 Tenable has extracted the preceding...

Amazon Linux 2022 : ctdb, libsmbclient, libsmbclient-devel (ALAS2022-2023-271)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-271 advisory. Integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested f...

Amazon Linux 2022 : emacs, emacs-common, emacs-devel (ALAS2022-2023-277)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-277 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation o...

Amazon Linux 2022 : wireshark-cli, wireshark-devel (ALAS2022-2023-268)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-268 advisory. Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file CVE-2022-3725 Tenable has extracted the preceding description block...

Amazon Linux 2022 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2022-2023-280)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2023-280 advisory. Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens opportunities for DoS. CVE-2023-21835 Better Banking of Sounds: JARSoundbankReader can load...

Amazon Linux 2022 : bcel, bcel-javadoc (ALAS2022-2023-275)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-275 advisory. Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitra...

Amazon Linux 2022 : ruby3.1, ruby3.1-bundled-gems, ruby3.1-default-gems (ALAS2022-2023-262)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-262 advisory. The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP...

Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2023-269)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-269 advisory. The target's backtrace indicates that libc has detected a heap error or that the target was executing a heap function when it stopped. This could be due to heap corruption, passing a bad pointer to a he...