Medium: openjpeg

Issue Overview: A heap-based buffer overflow was found in OpenJPEG. This flaw allows an attacker to execute arbitrary code with the permissions of the application compiled against OpenJPEG. CVE-2021-3575 Affected Packages: openjpeg Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-070)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-070 advisory. 2024-04-10: CVE-2023-0461 was added to this advisory. 2024-02-01: CVE-2024-0562 was added to this advisory. 2024-02-01: CVE-2022-48619 was added to this advisory. 2023-10-10: CVE-2023-3357 was...

Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2023-103)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-103 advisory. Integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested f...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-098)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-098 advisory. 2024-02-15: CVE-2022-3591 was added to this advisory. 2024-02-15: CVE-2022-3520 was added to this advisory. A flaw was found in vim. A possible heap-based buffer overflow could allow an attacke...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-117)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-117 advisory. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. CVE-2022-3234 Use After Free in GitHub repository vim/vim prior to 9.0.0490. CVE-2022-3235 Use After Free in GitHub...

Amazon Linux 2023 : giflib, giflib-devel, giflib-utils (ALAS2023-2023-075)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-075 advisory. An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over- read. CVE-2020-23922 There is a heap-buffer-overflow in GIFLIB 5.2.1 function...

Amazon Linux 2023 : libsepol, libsepol-devel, libsepol-static (ALAS2023-2023-017)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-017 advisory. The CIL compiler in SELinux 3.2 has a use-after-free in cilverifyclassperms called from cilverifyclasspermission and cilpreverifyhelper. CVE-2021-36084 The CIL compiler in SELinux 3.2 has a...

Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2023-106)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-106 advisory. Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be...

Amazon Linux 2023 : ncurses, ncurses-base, ncurses-c++-libs (ALAS2023-2023-023)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-023 advisory. The ncurses package tic is susceptible to a heap overflow on crafted input. When the terminfo entry- description compiler processes input, proper bounds checking was not enforced leading to thi...

Amazon Linux 2023 : minizip-compat, minizip-compat-devel, zlib (ALAS2023-2023-003)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-003 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large numbe...

[slackware-security] vim

New vim packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/vim-9.0.1418-i586-1slack15.0.txz: Upgraded. Fixed security issues: NULL pointer dereference issue in utfcptr2len. Incorrect Calculation o...

K000133070: Freetype vulnerability CVE-2020-15999

Security Advisory Description Freetype: Heap-based buffer overflow due to integer truncation in LoadSBitPng. CVE-2020-15999 Impact Certain library in F5OS requires the use of the vulnerable component. However, there is no known way to exploit this vulnerability on F5OS in default, standard, or...

CBL Mariner 2.0 Security Update: pango (CVE-2019-1010238)

The version of pango installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-1010238 advisory. - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow c...

Slackware Linux 15.0 / current vim Multiple Vulnerabilities (SSA:2023-079-02)

The version of vim installed on the remote host is prior to 9.0.1418. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-079-02 advisory. - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. CVE-2023-1170 - Incorrect Calculation of Buffer...

CBL Mariner 2.0 Security Update: vim (CVE-2023-0051)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-0051 advisory. - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. CVE-2023-0051 Note that Nessus has no...

CBL Mariner 2.0 Security Update: vim (CVE-2021-3973)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-3973 advisory. - vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3973 Note that Nessus has not tested for this issue but...

CBL Mariner 2.0 Security Update: vim (CVE-2023-0433)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-0433 advisory. - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. CVE-2023-0433 Note that Nessus has no...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Vim vulnerabilities (USN-5963-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5963-1 advisory. It was discovered that Vim was not properly performing memory management operations. An attacker could possibly use...

Fedora 38 : vim (2023-43cb13aefb)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-43cb13aefb advisory. Security fixes for CVE-2023-1175, CVE-2023-1170, CVE-2023-1264. Tenable has extracted the preceding description block directly from the Fedora...

CBL Mariner 2.0 Security Update: vim (CVE-2022-2343)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-2343 advisory. - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. CVE-2022-2343 Note that Nessus has no...