Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-372)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-372 advisory. The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending o...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-364)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-364 advisory. LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-367)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-367 advisory. The html/template package does not properly handle HTML-like comment tokens, nor hashbang ! comment tokens, in contexts. This may cause the template parser to improperly interpret the contents ...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-356)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-356 advisory. An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in readdescriptors in drivers/usb/core/sysfs.c. CVE-2023-37453 nftables...

Amazon Linux 2023 : jbigkit, jbigkit-devel, jbigkit-libs (ALAS2023-2023-376)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-376 advisory. A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attac...

Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2023-371)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-371 advisory. 2024-07-17: CVE-2022-27337 was added to this advisory. A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service DoS via a crafted PDF file...

Amazon Linux 2023 : mutt (ALAS2023-2023-357)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-357 advisory. Null pointer dereference when viewing a specially crafted email in Mutt 1.5.2 1.5.2 1.5.2 2.2.12 CVE-2023-4874 Null pointer dereference when composing from a spe...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2023-373)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-373 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2023-374)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-374 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : snakeyaml, snakeyaml-javadoc (ALAS2023-2023-375)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-375 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the...

WordPress Dropshipping & Affiliation with Amazon Plugin <= 2.1.2 is vulnerable to Arbitrary File Upload

Software Dropshipping & Affiliation with Amazon Type Plugin Vulnerable versions = 2.1.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-31215 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID fe2de1908435 Credits spacecroupier...

Low: amazon-ssm-agent

Issue Overview: No CVE associated with this advisory Affected Packages: amazon-ssm-agent Issue Correction: Run dnf update amazon-ssm-agent --releasever 2023.2.20231002 or dnf update --advisory ALAS2023-2023-373 --releasever 2023.2.20231002 to update your system. More information on how to update...

Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2023-359)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-359 advisory. A flaw was found in glibc. When the getaddrinfo function is called with the AFUNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-360)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-360 advisory. Use After Free in GitHub repository vim/vim prior to 9.0.1840. CVE-2023-4733 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. CVE-2023-4734 Out-of-bounds Write in...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-368)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-368 advisory. HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1NOTE: https://curl.se/docs/CVE-2023-38039.htmlNOTE: Introduced by:...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-365)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-365 advisory. URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-369)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-369 advisory. Visual Studio Remote Code Execution Vulnerability CVE-2023-36792 Visual Studio Remote Code Execution Vulnerability CVE-2023-36793 Visual Studio Remote Code Execution Vulnerability CVE-2023-3679...

Amazon Linux 2023 : libwebp, libwebp-devel, libwebp-java (ALAS2023-2023-358)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-358 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : libtommath, libtommath-devel (ALAS2023-2023-370)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-370 advisory. Integer Overflow vulnerability in mpgrow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service DoS...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-362)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-362 advisory. In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer...