Amazon Linux 2022 : cups, cups-client, cups-devel (ALAS2022-2022-203)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-203 advisory. An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as...

Amazon Linux 2022 : vsftpd (ALAS2022-2022-172)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-172 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates...

Amazon Linux 2022 : blas, blas64, blas64_ (ALAS2022-2022-173)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-173 advisory. An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack and OpenBLAS. A specially crafted input passed to these functions could cause an application using lapa...

Amazon Linux 2022 : flac, flac-devel, flac-libs (ALAS2022-2022-163)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-163 advisory. An out-of-bounds write vulnerability was found in libFlak. The vulnerability occurs due to a missing bounds check. This flaw allows a local attacker without additional execution privileges to cause loca...

Amazon Linux 2022 : postgresql14, postgresql14-contrib, postgresql14-llvmjit (ALAS2022-2022-190)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-190 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH...

Amazon Linux 2022 : harfbuzz, harfbuzz-devel, harfbuzz-icu (ALAS2022-2022-181)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-181 advisory. HarfBuzz 2.9.0 has an out-of-bounds write in hbbitsetinvertiblet::set called from hbsparsesett::set and hbsetcopy. CVE-2021-45931 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2022 : libsndfile, libsndfile-devel, libsndfile-utils (ALAS2022-2022-175)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-175 advisory. An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file via tricking a user to open or otherwise to an application linke...

Amazon Linux 2022 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2022-2022-182)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-182 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability...

Amazon Linux 2022 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2022-2022-164)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-164 advisory. A divide-by-zero flaw was found in ImageMagick in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a divisio...

Amazon Linux 2022 : jdom, jdom-demo, jdom-javadoc (ALAS2022-2022-168)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-168 advisory. An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. CVE-2021-33813 Tenable has extracted the preceding description block directly...

Amazon Linux 2022 : gmp, gmp-c++, gmp-devel (ALAS2022-2022-177)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-177 advisory. A flaw was found in gmp. An integer overflow vulnerability could allow an attacker to input an integer value leading to a crash. The highest threat from this vulnerability is to system availability...

Amazon Linux 2022 : bind, bind-chroot, bind-devel (ALAS2022-2022-166)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-166 advisory. A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This...

Amazon Linux 2022 : openssl, openssl-devel, openssl-libs (ALAS2022-2022-195)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-195 advisory. A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command execute...

Amazon Linux 2022 : libtiff, libtiff-devel, libtiff-static (ALAS2022-2022-194)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-194 advisory. A divide-by-zero vulnerability was found in libtiff. This flaw allows an attacker to cause a denial of service via a crafted tiff file. CVE-2022-2056 A divide-by-zero vulnerability was found in...

Amazon Linux 2022 : libinput, libinput-devel, libinput-test (ALAS2022-2022-186)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-186 advisory. A format string vulnerability was found in libinput CVE-2022-1215 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not teste...

Amazon Linux 2022 : libsolv, libsolv-demo, libsolv-devel (ALAS2022-2022-167)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-167 advisory. A flaw was found in libsolv. A buffer overflow vulnerability could cause a denial of service. The highest threat from this vulnerability is to system availability. CVE-2021-3200 Tenable has extracted th...

Amazon Linux 2022 : logrotate (ALAS2022-2022-189)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-189 advisory. A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock...

Amazon Linux 2022 : zziplib, zziplib-devel, zziplib-utils (ALAS2022-2022-162)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-162 advisory. Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value zzipfileread in the function unzzipcatfile. CVE-2020-18442 Tenable has extracted the preceding...

Amazon Linux 2022 : python3-lxml (ALAS2022-2022-178)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-178 advisory. There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using python-lxml's...

Amazon Linux 2022 : fribidi, fribidi-devel (ALAS2022-2022-200)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-200 advisory. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory...