Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2022-002)

The version of java-11-openjdk installed on the remote host is prior to 11.0.16.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2022-002 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java S...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2022-1836)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.342.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1836 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package...

Amazon Linux 2 : microcode_ctl (ALAS-2022-1842)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1842 advisory. 2024-02-15: CVE-2022-0005 was added to this advisory. Sensitive information accessible by physical probing of JTAG...

Amazon Linux 2 : python-bottle (ALAS-2022-1844)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1844 advisory. Bottle before 0.12.20 mishandles errors during early request binding. CVE-2022-31799 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-035)

The version of kernel installed on the remote host is prior to 5.4.209-116.367. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-035 advisory. An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1838 (ALAS-2022-1838)

The version of kernel installed on the remote host is prior to 4.14.291-218.527. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1838 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the...

Amazon Linux 2 : postgresql (ALAS-2022-1843)

The version of postgresql installed on the remote host is prior to 9.2.24-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1843 advisory. 2024-05-23: CVE-2021-32027 was added to this advisory. 2024-05-23: CVE-2023-5869 was added to this advisory. A flaw wa...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-007)

The version of kernel installed on the remote host is prior to 5.15.59-33.133. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-007 advisory. An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a...

Important: java-1.8.0-openjdk

Issue Overview: Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an arbitrary class. CVE-2022-21541 The Xalan Java XSLT library has an integer truncation issue...

Medium: python-bottle

Issue Overview: Bottle before 0.12.20 mishandles errors during early request binding. CVE-2022-31799 Affected Packages: python-bottle Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issu...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2022-1633)

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.321-2.6.28.1.86. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1633 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2022 : freerdp, freerdp-devel, freerdp-libs (ALAS2022-2022-082)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-082 advisory. A flaw was found in the FreeRDP client when it fails to validate input data when using gateway connections. This flaw could allow a malicious gateway to send a specially crafted input to a clie...

Amazon Linux 2022 : httpd, httpd-core, httpd-devel (ALAS2022-2022-110)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-110 advisory. An HTTP request smuggling vulnerability was found in the modproxyajp module of httpd. This flaw allows an attacker to smuggle requests to the AJP server, where it forwards requests...

Amazon Linux 2022 : cups, cups-client, cups-devel (ALAS2022-2022-108)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-108 advisory. An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as...

Amazon Linux 2022 : bsdcat, bsdcpio, bsdtar (ALAS2022-2022-059)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-059 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provid...

Amazon Linux 2022 : clamav, clamav-data, clamav-devel (ALAS2022-2022-090)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-090 advisory. A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause...

Amazon Linux 2022 : fribidi, fribidi-devel (ALAS2022-2022-091)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-091 advisory. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory...

Amazon Linux 2022 : git, git-all, git-core (ALAS2022-2022-118)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-118 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration...

Amazon Linux 2022 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2022-2022-112)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-112 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2022-2022-089)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-089 advisory. A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local attackers gaining root privileges. CVE-2022-27239 A flaw was found...