Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2023-104)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-104 advisory. Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non- default configuration. The Python multiprocessing library, when used with the forkserver...

Amazon Linux 2023 : less (ALAS2023-2023-123)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-123 advisory. 2024-02-29: CVE-2022-48624 was added to this advisory. In GNU Less before 609, crafted data can result in less -R not filtering ANSI escape sequences sent to the terminal. CVE-2022-46663...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2023-020)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-020 advisory. A flaw was found in grub 2, where a crafted 16-bit grayscale PNG image may lead to an out-of-bounds write. This flaw allows an attacker to corrupt the data on the heap portion of the grub2's...

Amazon Linux 2023 : aws-nitro-enclaves-cli, aws-nitro-enclaves-cli-devel, aws-nitro-enclaves-cli-integration-tests (ALAS2023-2023-129)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-129 advisory. Hyperium Hyper before 0.14.19 does not allow for customization of the maxheaderlistsize method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. CVE-2022-31394 Tenable has...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-055)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-055 advisory. 2024-06-06: CVE-2021-33117 was added to this advisory. Improper access control for some 3rd Generation IntelR XeonR Scalable Processors before BIOS version MR7, may allow a local attacker to...

Amazon Linux 2023 : libksba, libksba-devel (ALAS2023-2023-088)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-088 advisory. A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing speciall...

Amazon Linux 2023 : device-mapper-multipath, device-mapper-multipath-devel, device-mapper-multipath-libs (ALAS2023-2023-126)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-126 advisory. A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local user...

Amazon Linux 2023 : python3-bottle (ALAS2023-2023-082)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-082 advisory. Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. CVE-2022-3179 Bottle before 0.12.20 mishandles errors during early request binding. CVE-2022-31799 Tenable has...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-067)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-067 advisory. There is a double free or corruption in rotateImage at tiffcrop.c:8839 found in libtiff 4.4.0rc1. CVE-2022-2519 A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-101)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-101 advisory. A flaw was found in Open SSL. A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain...

Amazon Linux 2023 : libinput, libinput-devel, libinput-test (ALAS2023-2023-041)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-041 advisory. A format string vulnerability was found in libinput CVE-2022-1215 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not teste...

Amazon Linux 2023 : golist (ALAS2023-2023-046)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-046 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2023 : compat-golang-github-cpuguy83-md2man-2-devel, golang-github-cpuguy83-md2man, golang-github-cpuguy83-md2man-devel (ALAS2023-2023-047)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-047 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Amazon Linux 2023 : sysstat (ALAS2023-2023-094)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-094 advisory. sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocatestructures contains a sizet overflow in...

Amazon Linux 2023 : cpio (ALAS2023-2023-021)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-021 advisory. GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is...

Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2023-113)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-113 advisory. Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked...

Amazon Linux 2023 : python3-werkzeug (ALAS2023-2023-125)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-125 advisory. Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a smal...

Amazon Linux 2023 : cryptsetup, cryptsetup-devel, cryptsetup-libs (ALAS2023-2023-027)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-027 advisory. It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk...

Amazon Linux 2023 : bsdcat, bsdcpio, bsdtar (ALAS2023-2023-071)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-071 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provid...

Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2023-106)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-106 advisory. Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be...