Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-422)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-422 advisory. 2024-07-03: CVE-2023-52522 was added to this advisory. 2024-07-03: CVE-2023-52559 was added to this advisory. 2024-07-03: CVE-2023-52523 was added to this advisory. 2024-06-06: CVE-2023-52481 w...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-420)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-420 advisory. An issue was found in libcurl which allows cookies to be inserted into a running program if specific conditions are met. The libcurl provided function, curleasyduphandle, is used to duplicate t...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-416)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-416 advisory. Samba is vulnerable to path traversal due to insufficient sanitization of clients incoming pipe names. This can lead to the client connecting to as root to a Unix domain socket outside of the...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-405)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-405 advisory. RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file CVE-2023-5371 Tenable has extracted the preceding...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2023-408)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-408 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-406)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-406 advisory. A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. A truncati...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-412)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-412 advisory. When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2023-409)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-409 advisory. An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-415)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-415 advisory. Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1...

Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2023-411)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-411 advisory. libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think these issues...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2023-426)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-426 advisory. 2023-11-09: CVE-2023-22081 was added to this advisory. 2023-11-09: CVE-2023-22067 was added to this advisory. An issue was discovered in function ciMethodBlocks::makeblockat in Oracle JDK HotSp...

Amazon Linux 2023 : libvpx, libvpx-devel, libvpx-utils (ALAS2023-2023-413)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-413 advisory. VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. CVE-2023-44488 Tenable has extracted the preceding description block directly from the tested product security...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2023-404)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-404 advisory. A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the...

Amazon Linux 2023 : jackson-databind (ALAS2023-2023-428)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-428 advisory. jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service 2 GB transient heap usage per read in uncommon situations involving JsonNode J...

Important: cni-plugins

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cni-plugins Issue Correction: Run dnf update cni-plugi...

Amazon Linux 2023 : squid (ALAS2023-2023-402)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-402 advisory. Due to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest Authentication CVE-2023-46847 Tenable has extracted the preceding description block directly from the...

Important: runc

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: runc Issue Correction: Run dnf update runc --releaseve...

Medium: ImageMagick

Issue Overview: 2024-06-06: CVE-2021-20309 was added to this advisory. A flaw was found in ImageMagick, where a division by zero in WaveImage of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat fr...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-385)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-385 advisory. In the Linux kernel, the following vulnerability has been resolved: ceph: drop messages from MDS when unmounting CVE-2022-48628 A use-after-free vulnerability in the Linux kernel's netfilter:...

Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2023-399)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-399 advisory. Memory corruption bug on JDK 21 and 20 when AVX-512 is enabled. CVE-2023-22025 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE component: JSSE. Supported...