Amazon Linux 2022 : openssl (ALAS2022-2022-104)

The version of openssl installed on the remote host is prior to 3.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-104 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is...

Amazon Linux 2022 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2022-2022-069)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-069 advisory. MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW. CVE-2021-46659 MariaDB through 10.5.9 allows an application cras...

Amazon Linux 2022 : libtiff, libtiff-devel, libtiff-static (ALAS2022-2022-094)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-094 advisory. A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a hea...

Amazon Linux 2022 : openexr, openexr-devel, openexr-libs (ALAS2022-2022-061)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-061 advisory. An integer overflow could occur when OpenEXR processes a crafted file on systems where sizet is less than 64 bits. This issue could cause an invalid bytesPerLine and maxBytesPerLine value, whic...

Amazon Linux 2022 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2022-2022-112)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-112 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : zsh, zsh-html (ALAS2022-2022-117)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-117 advisory. A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code execution if they control a command output inside the prompt, as stated by ...

Amazon Linux 2022 : wireshark-cli, wireshark-devel (ALAS2022-2022-079)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-079 advisory. A NULL pointer exception flaw was found in Wireshark. A process failure on crafted or malformed input in the IPPUSB dissector can cause a denial of service via a packet injection or a crafted...

Amazon Linux 2022 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2022-2022-120)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-120 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : microcode_ctl (ALAS2022-2022-129)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-129 advisory. A flaw was found in hw. The APIC can operate in xAPIC mode also known as a legacy mode, in which APIC configuration registers are exposed through a memory-mapped I/O MMIO page. This flaw allows...

Amazon Linux 2022 : git, git-all, git-core (ALAS2022-2022-067)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-067 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration...

Amazon Linux 2022 : rubygem-puma (ALAS2022-2022-051)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-051 advisory. A flaw was found in rubygem-puma. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starv...

Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-065)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-065 advisory. A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials s...

Amazon Linux 2022 : java-latest-openjdk, java-latest-openjdk-demo, java-latest-openjdk-devel (ALAS2022-2022-037)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-037 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311,...

Amazon Linux 2022 : java-11-openjdk, java-11-openjdk-demo, java-11-openjdk-devel (ALAS2022-2022-047)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-047 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311,...

Amazon Linux 2022 : fish (ALAS2022-2022-056)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-056 advisory. fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of gi...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-042)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-042 advisory. A flaw was found in the Linux kernel in linux/net/netfilter/nftablesapi.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. CVE-2022-1015 A flaw w...

Amazon Linux 2022 : logrotate (ALAS2022-2022-095)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-095 advisory. A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock...

Amazon Linux 2022 : maven-shared-utils, maven-shared-utils-javadoc (ALAS2022-2022-060)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-060 advisory. org.apache.maven.shared:maven-shared-utils is a functional replacement for plexus-utils in Maven. Affected versions of this package are vulnerable to Command Injection. The Commandline class can emit...

Amazon Linux 2022 : microcode_ctl (ALAS2022-2022-070)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-070 advisory. Sensitive information accessible by physical probing of JTAG interface for some IntelR Processors with SGX may allow an unprivileged user to potentially enable information disclosure via physic...

Amazon Linux 2022 : cpp, gcc, gcc-c++ (ALAS2022-2022-057)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-057 advisory. A flaw was found in the way Unicode standards are implemented in the context of development environments, which have specialized requirements for rendering text. An attacker could exploit this to deceiv...