Amazon Linux 2023 : glib2, glib2-devel, glib2-static (ALAS2023-2023-225)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-225 advisory. The upstream bug report describes this issue as follows: A vulnerability was found in GLib2.0, where DoS caused by handling a malicious text-form variant which is structured to cause looping...

Amazon Linux 2023 : json-c, json-c-devel (ALAS2023-2023-232)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-232 advisory. A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to...

Amazon Linux 2023 : cloud-init (ALAS2023-2023-196)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-196 advisory. Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. CVE-2023-1786 Tenable...

Amazon Linux 2023 : libcap, libcap-devel, libcap-static (ALAS2023-2023-195)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-195 advisory. libcap is vulnerable to a denial of service caused by the error handling in wrappthreadcreate function, which will cause memory to be leaked in the case of an error. CVE-2023-2602 Tenable has extracted...

dnf-plugins-core bug fix and enhancement update

An update is available for dnf-plugins-core. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2023-178)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-178 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Tenable has...

Amazon Linux 2023 : nasm, nasm-rdoff (ALAS2023-2023-172)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-172 advisory. NASM v2.16 was discovered to contain a heap buffer overflow in the component quoteforpmake asm/nasm.c:856 CVE-2022-44370 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-147)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-147 advisory. org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-142)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-142 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

Amazon Linux 2023 : cpp, gcc, gcc-c++ (ALAS2023-2023-145)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-145 advisory. libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangleconst, as demonstrated by nm-new. CVE-2022-27943 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2023-131)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-131 advisory. A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo and ProcXkbGetDeviceInfo to read and write into...

Amazon Linux 2023 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2023-2023-068)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-068 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This...

Amazon Linux 2023 : zsh, zsh-html (ALAS2023-2023-035)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-035 advisory. A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code execution if they control a command output inside the prompt, as stated by ...

Amazon Linux 2023 : e2fsprogs, e2fsprogs-devel, e2fsprogs-libs (ALAS2023-2023-044)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-044 advisory. An out-of-bounds read/write vulnerability was found in e2fsprogs. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem. CVE-2022-1304 Tenable...

Amazon Linux 2023 : dnsmasq, dnsmasq-utils (ALAS2023-2023-039)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-039 advisory. A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service...

Amazon Linux 2023 : gmp, gmp-c++, gmp-devel (ALAS2023-2023-033)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-033 advisory. A flaw was found in gmp. An integer overflow vulnerability could allow an attacker to input an integer value leading to a crash. The highest threat from this vulnerability is to system availability...

K52013062: Ansible Engine vulnerability CVE-2020-14365

Security Advisory Description A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disablegpgcheck is set to False, which is the...

SUSE CVE-2020-14365

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disablegpgcheck is set to False, which is the default behavior. This flaw...

CVE-2022-4210

The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquizlist' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WordPress plugin Chained Quiz 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...