Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2024-776)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-776 advisory. .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024-43483 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024-43484 .NET and Visual...

Amazon Linux 2022 : freetype, freetype-demos, freetype-devel (ALAS2022-2022-033)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-033 advisory. A heap buffer overflow leading to out-of-bounds write was found in freetype. Memory allocation based on truncated PNG width and height values allows for an out-of-bounds write to occur in application...

Amazon Linux 2022 : log4j, log4j-jcl, log4j-slf4j (ALAS2022-2022-011)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-011 advisory. Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack where an attacker with permission to modify the...

Amazon Linux 2022 : lua, lua-devel, lua-libs (ALAS2022-2022-031)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-031 advisory. A stack overflow issue was discovered in Lua in the luaresume function of ldo.c. This flaw allows a local attacker to pass a specially crafted file to the Lua Interpreter, causing a crash that...

Amazon Linux 2022 : flatpak, flatpak-devel, flatpak-libs (ALAS2022-2022-021)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-021 advisory. An incorrect authorization vulnerability was found in Flatpak. Flatpak does not properly validate that the permissions displayed to the user for an app at install time match the actual...

Amazon Linux 2022 : webkit2gtk3, webkit2gtk3-devel, webkit2gtk3-jsc (ALAS2022-2022-015)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-015 advisory. A use-after-free flaw was found in WebKitGTK. Specially crafted web content could use this flaw to trigger an arbitrary code execution when processed. CVE-2021-30809 A confusion type flaw was...

Amazon Linux 2022 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2022-2022-013)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-013 advisory. An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations a...

Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2024-783)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-783 advisory. An issue was discovered in xmllint from libxml2 before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2024-777)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-777 advisory. .NET and Visual Studio Remote Code Execution Vulnerability CVE-2024-38229 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024-43483 .NET, .NET Framework, and Visual...

Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-023)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-023 advisory. A flaw was found in vim. The vulnerability occurs due to too many recursions, which can lead to a segmentation fault. This flaw allows an attacker to input a specially crafted file, leading to ...

Amazon Linux 2023 : avahi, avahi-autoipd, avahi-compat-howl (ALAS2023-2024-771)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-771 advisory. avahi: Avahi Wide-Area DNS Uses Constant Source Port CVE-2024-52615 avahi: Avahi Wide-Area DNS Predictable Transaction IDs CVE-2024-52616 Tenable has extracted the preceding description block...

Amazon Linux 2022 : log4j, log4j-jcl, log4j-slf4j (ALAS2022-2021-003)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2021-003 advisory. A flaw was found in the Java logging library Apache Log4j 2 in versions from 2.0-beta9 and before and including 2.14.1. This could allow a remote attacker to execute code on the server if the system log...

Amazon Linux 2022 : expat, expat-devel, expat-static (ALAS2022-2022-017)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-017 advisory. In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc misbehavior e.g., allocating too few bytes, or only freeing...

Amazon Linux 2023 : apr, apr-devel (ALAS2023-2024-789)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-789 advisory. Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2024-781)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-781 advisory. Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the...

Amazon Linux 2022 : ctdb, ctdb-pcp-pmda, libsmbclient (ALAS2022-2022-022)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-022 advisory. A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-784)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-784 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow timeout for anonymous sets CVE-2023-52620 In the Linux kernel, the following vulnerability has...

Amazon Linux 2022 : qt, qt-assistant, qt-common (ALAS2022-2021-006)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2021-006 advisory. Qt5 versions up to qt 5.12.7, qt 5.14.1, qt 5.15.0 allows plugins to be loaded from current working directory, this can lead to compromised plugins to loaded leading to possible arbitrary code execution...

Amazon Linux 2022 : httpd, httpd-devel, httpd-filesystem (ALAS2022-2022-018)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-018 advisory. There's a null pointer dereference and server-side request forgery flaw in httpd's modproxy module, when it is configured to be used as a forward proxy. A crafted packet could be sent on the...

Amazon Linux 2023 : python3-requests, python3-requests+security, python3-requests+socks (ALAS2023-2024-782)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-782 advisory. Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the...