Amazon Linux 2022 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2022-2022-121)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-121 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2022-2022-119)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-119 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : flac, flac-devel, flac-libs (ALAS2022-2022-066)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-066 advisory. An out-of-bounds write vulnerability was found in libFlak. The vulnerability occurs due to a missing bounds check. This flaw allows a local attacker without additional execution privileges to cause loca...

Amazon Linux 2022 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2022-2022-130)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-130 advisory. A stack based buffer-overflow vulnerability was found in the deprecated compatibility function clntcreate in the sunrpc's clntgen.c module of the GNU C Library aka glibc through 2.34. This vulnerability...

Amazon Linux 2022 : bsdcat, bsdcpio, bsdtar (ALAS2022-2022-103)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-103 advisory. An out-of-bounds read flaw was found in libarchive. This flaw allows an attacker who can supply a specially crafted zip file to libarchive to cause an out-of-bounds read in programs linked with...

Amazon Linux 2022 : libinput, libinput-devel, libinput-test (ALAS2022-2022-092)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-092 advisory. A format string vulnerability was found in libinput CVE-2022-1215 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not teste...

Amazon Linux 2022 : kernel-livepatch-5.15.29-16.111 (ALAS2022-2022-101)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-101 advisory. A use-after-free flaw was found in the Linux kernel's iouring interface subsystem in the way a user triggers a race condition between timeout flush and removal. This flaw allows a local user to crash or...

Amazon Linux 2022 : perl-CPAN, perl-CPAN-tests (ALAS2022-2022-072)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-072 advisory. A flaw was found in the way the perl-CPAN performed verification of package signatures stored in CHECKSUMS files. A malicious or compromised CPAN server used by a user, or a man-in-the-middle attacker,...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-125)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-125 advisory. A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. CVE-2022-2990...

Amazon Linux 2022 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2022-2022-096)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-096 advisory. A use-after-free vulnerability was found in MariaDB. This flaw allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used, resulting in a denial of service...

Amazon Linux 2022 : openjpeg2, openjpeg2-devel, openjpeg2-tools (ALAS2022-2022-122)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-122 advisory. A flaw was found in the opj2decompress program in openjpeg2 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of t...

Amazon Linux 2022 : rubygem-nokogiri (ALAS2022-2022-062)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-062 advisory. Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this issue. CVE-2022-24836 Tenable has extracted the preceding description block directly...

Amazon Linux 2022 : httpd, httpd-core, httpd-devel (ALAS2022-2022-053)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-053 advisory. A flaw was found in the modlua module of httpd. A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function. The...

Amazon Linux 2022 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2022-2022-126)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-126 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control...

Amazon Linux 2022 : microcode_ctl (ALAS2022-2022-129)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-129 advisory. A flaw was found in hw. The APIC can operate in xAPIC mode also known as a legacy mode, in which APIC configuration registers are exposed through a memory-mapped I/O MMIO page. This flaw allows...

Amazon Linux 2022 : microcode_ctl (ALAS2022-2022-070)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-070 advisory. Sensitive information accessible by physical probing of JTAG interface for some IntelR Processors with SGX may allow an unprivileged user to potentially enable information disclosure via physic...

Amazon Linux 2022 : logrotate (ALAS2022-2022-095)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-095 advisory. A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock...

Amazon Linux 2022 : php, php-bcmath, php-cli (ALAS2022-2022-073)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-073 advisory. A flaw was found in php. The main cause of this vulnerability is improper input validation while parsing an Extensible Markup LanguageXML entity. A special character could allow an attacker to...

Amazon Linux 2022 : libblkid, libblkid-devel, libfdisk (ALAS2022-2022-099)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-099 advisory. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to...

Amazon Linux 2022 : wireshark-cli, wireshark-devel (ALAS2022-2022-079)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-079 advisory. A NULL pointer exception flaw was found in Wireshark. A process failure on crafted or malformed input in the IPPUSB dissector can cause a denial of service via a packet injection or a crafted...