Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-027 (ALASKERNEL-5.15-2023-027)

The version of kernel installed on the remote host is prior to 5.15.133-86.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-027 advisory. An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2023-003)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2OPENSSL-SNAPSAFE-2023-003 advisory. Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:...

Amazon Linux 2 : djvulibre (ALASMATE-DESKTOP1.X-2023-003)

The version of djvulibre installed on the remote host is prior to 3.5.27-30. It is, therefore, affected by a vulnerability as referenced in the ALAS2MATE-DESKTOP1.X-2023-003 advisory. An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via...

Amazon Linux AMI : golang (ALAS-2023-1848)

The version of golang installed on the remote host is prior to 1.20.8-1.47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1848 advisory. 2024-01-03: CVE-2023-24537 was added to this advisory. 2024-01-03: CVE-2023-29400 was added to this advisory. 2024-01-03...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-014)

The version of firefox installed on the remote host is prior to 102.15.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-014 advisory. Memory corruption in IPC CanvasTranslator CVE-2023-4573 Memory corruption in IPC ColorPickerShownCallback...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-040 (ALASKERNEL-5.10-2023-040)

The version of kernel installed on the remote host is prior to 5.10.196-185.743. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-040 advisory. An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bound...

Medium: libtiff

Issue Overview: libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage in tiffcrop cause heap-buffer-overflow and SEGV. CVE-2023-25433 A vulnerability was found in libtiff library. This security flaw causes a heap...

Important: java-1.8.0-openjdk

Issue Overview: An issue was discovered in function ciMethodBlocks::makeblockat in Oracle JDK HotSpot VM 11, 17 and OpenJDK HotSpot VM 8, 11, 17, allows attackers to cause a denial of service. CVE-2022-40433 Affected Packages: java-1.8.0-openjdk Note: This advisory is applicable to Amazon Linux 2...

Medium: mutt

Issue Overview: Null pointer dereference when viewing a specially crafted email in Mutt 1.5.2 1.5.2 2.2.12 CVE-2023-4875 Affected Packages: mutt Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

Medium: mdadm

Issue Overview: Buffer overflow in some IntelR SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2023-28736 Uncontrolled resource consumption in some IntelR SSD Tools software before version mdadm-4.2-rc...

Important: python-reportlab

Issue Overview: paraparser in ReportLab before 3.5.31 allows remote code execution because startunichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with 'unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626...

Medium: nasm

Issue Overview: A Use After Free vulnerability in function newToken in asm/preproc.c in nasm 2.14.02 allows attackers to cause a denial of service via crafted nasm command. CVE-2020-18780 A Segmentation Fault issue discovered in in ieeesegment function in outieee.c in nasm 2.14.03 and 2.15 allows...

Amazon Linux 2 : freerdp (ALAS-2023-2269)

The version of freerdp installed on the remote host is prior to 2.11.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2269 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. This issue affect...

Ubuntu 18.04 ESM : Linux kernel (KVM) vulnerabilities (USN-6396-2)

The remote Ubuntu 18.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6396-2 advisory. It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread....

Ubuntu 18.04 ESM : Django vulnerabilities (USN-6414-2)

The remote Ubuntu 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6414-2 advisory. USN-6414-1 and USN-6378-1 fixed CVE-2023-43665 and CVE-2023-41164 in Django, respectively. This update provides the corresponding update for Ubuntu 18.04...

Amazon Linux 2 : libtiff (ALAS-2023-2274)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2274 advisory. libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size afte...

Amazon Linux 2 : expat (ALAS-2023-2280)

The version of expat installed on the remote host is prior to 2.1.0-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2280 advisory. Expat aka libexpat before 2.4.4 has an integer overflow in the doProlog function. CVE-2022-23990 A flaw was found in expat....

Amazon Linux 2 : kernel, --advisory ALAS2-2023-2264 (ALAS-2023-2264)

The version of kernel installed on the remote host is prior to 4.14.326-245.539. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2264 advisory. A flaw was found in the Linux kernel's IP framework for transforming packets XFRM subsystem. This issue may allow ...

Fedora: Security Advisory for golang-github-nats-io-jwt-2 (FEDORA-2023-f122ea1b3e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2023:3291-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...