Medium: future

Issue Overview: An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. CVE-2022-40899 Affected Packages: future Issue Correction: Run dnf update future --releasever...

Amazon Fire TV Stick 跨站脚本漏洞

The Amazon Fire TV Stick is a TV voice recognition remote control from Amazon.com, Inc. A security vulnerability exists in the Amazon Fire TV Stick that stems from the setMediaSource function on the amzn.thin.pl service not being cleaned up...

PT-2023-16947 · Amazon +1 · Fire Os +2

Name of the Vulnerable Software and Affected Versions: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5 Insignia TV with FireOS version 7.6.3.3 Description: The issue is related to an improper JPAKE implementation, which allows offline PIN brute-forcing due to the initialization of random...

Amazon Linux 2023 : nasm, nasm-rdoff (ALAS2023-2023-172)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-172 advisory. NASM v2.16 was discovered to contain a heap buffer overflow in the component quoteforpmake asm/nasm.c:856 CVE-2022-44370 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2023 : apache-ivy, apache-ivy-javadoc (ALAS2023-2023-174)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-174 advisory. A flaw was found in Apache Ivy. With Apache Ivy 2.4.0, an optional packaging attribute was introduced that allows artifacts to be unpacked on the fly if pack200 or zip packaging was used. This...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2023-166)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-166 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,...

Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2023-171)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-171 advisory. A timing side-channel vulnerability was found in RSA ClientKeyExchange messages in GnuTLS. This side- channel may be sufficient to recover the key encrypted in the RSA ciphertext across a network in a...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-165)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-165 advisory. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token JWT...

Amazon Fire TV Stick 安全漏洞

The Amazon Fire TV Stick is a TV voice recognition remote control from Amazon.com, Inc. A security vulnerability exists in the Amazon Fire TV Stick that stems from improper workflow execution of the exchangeDeviceServices function of the amzn.dmgr service...

PT-2023-16946 · Amazon +1 · Amazon Fire Tv Stick +1

Name of the Vulnerable Software and Affected Versions: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5 Insignia TV with FireOS versions prior to 7.6.3.3 Description: The issue is related to the setMediaSource function on the amzn.thin.pl service, which does not properly sanitize the source...

Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-170)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-170 advisory. Possible heap-based buffer overflow attack in ImportMultiSpectralQuantum in MagickCore/quantum-import.c for ImageMagick CVE-2023-1906 Tenable has extracted the preceding description block directly from...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-164)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-164 advisory. Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2023-168)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-168 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-175)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-175 advisory. Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. CVE-2022-23772 cmd/go in Go before 1.16.14 and 1.17.x...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2023-167)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-167 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-176)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-176 advisory. The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing but extremely hard to trigger concurrency bug...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-162)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-162 advisory. In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode,...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-169)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-169 advisory. An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to...

Medium: pcs

Issue Overview: The Ruby on Rails advisory describes this vulnerability as follows: Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack virtually all...

Important: tomcat

Issue Overview: When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. CVE-2017-12616 When using the RemoteIpFilter with...