Amazon Linux 2 : xorg-x11-server (ALAS-2023-2352)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2352 advisory. A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration a multi-screen setup with multiple protocol screens, also known as Zaphod...

Amazon Linux 2 : advancecomp (ALAS-2023-2361)

The version of advancecomp installed on the remote host is prior to 1.15-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2361 advisory. advancecomp has a segmentation fault on invalid MNG size CVE-2023-2961 Tenable has extracted the preceding description block...

Amazon Linux 2 : avahi (ALAS-2023-2372)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2372 advisory. A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi...

Amazon Linux 2 : python-pip (ALAS-2023-2349)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2349 advisory. When installing a package from a Mercurial VCS URL ie pip installhg+... with pip prior to v23.3, the specified Mercurial revision couldbe used to inject arbitrary configuration options to the hg clonecall...

Amazon Linux 2 : kernel (ALAS-2023-2359)

The version of kernel installed on the remote host is prior to 4.14.330-250.540. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2359 advisory. 2024-12-05: CVE-2023-52868 was added to this advisory. 2024-12-05: CVE-2023-52867 was added to this advisory...

Amazon Linux 2 : libarchive (ALAS-2023-2374)

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2374 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists,...

Amazon Linux 2 : binutils (ALAS-2023-2373)

The version of binutils installed on the remote host is prior to 2.29.1-31. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2373 advisory. An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangletype in...

Amazon Linux 2 : libarchive (ALAS-2023-2364)

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2364 advisory. In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 (RHSA-2023:7637)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7637 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

Amazon Linux 2 : vim (ALAS-2023-2353)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2353 advisory. Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be...

Amazon Linux 2 : indent (ALAS-2023-2358)

The version of indent installed on the remote host is prior to 2.2.11-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2358 advisory. GNU indent 2.2.13 has a heap-based buffer overflow in searchbrace in indent.c via a crafted file. CVE-2023-40305 Tenable has...

Amazon Linux 2 : openssl11 (ALAS-2023-2351)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2351 advisory. Issue summary: Generating excessively long X9.42 DH keys or checkingexcessively long X9.42 DH keys or parameters may be very...

Amazon Linux 2 : gmp (ALAS-2023-2369)

The version of gmp installed on the remote host is prior to 6.0.0-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2369 advisory. A flaw was found in gmp. An integer overflow vulnerability could allow an attacker to input an integer value leading to a crash. The...

Amazon Linux 2 : glibc (ALAS-2023-2371)

The version of glibc installed on the remote host is prior to 2.26-57. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2371 advisory. 2023-12-14: CVE-2021-33574 was added to this advisory. The mqnotify function in the GNU C Library aka glibc has a...

Amazon Linux 2 : compat-libtiff3 (ALAS-2023-2346)

The version of compat-libtiff3 installed on the remote host is prior to 3.9.4-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2346 advisory. An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen API may allow a remote attacker to cau...

Amazon Linux 2 : virtuoso-opensource (ALAS-2023-2360)

The version of virtuoso-opensource installed on the remote host is prior to 7.2.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2360 advisory. 2024-03-13: CVE-2023-31618 was added to this advisory. 2024-03-13: CVE-2023-31627 was added to this advisory...

Amazon Linux 2 : uriparser (ALAS-2023-2368)

The version of uriparser installed on the remote host is prior to 0.7.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2368 advisory. An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax. CVE-2021-46142...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 (RHSA-2023:7638)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7638 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

Amazon Linux 2 : jettison (ALAS-2023-2363)

The version of jettison installed on the remote host is prior to 1.3.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2363 advisory. Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser is...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2023-004)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2OPENSSL-SNAPSAFE-2023-004 advisory. Issue summary: Generating excessively long X9.42 DH keys or checkingexcessively long X9.42 DH keys or...