Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2023-023)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-023 advisory. containerd is an open source container runtime. A bug was found in containerd's CRI implementation where ...

Ubuntu: Security Advisory (USN-6001-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2 : docker (ALASDOCKER-2023-022)

The version of docker installed on the remote host is prior to 20.10.23-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-022 advisory. A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the...

AZL-26032 CVE-2023-1838 affecting package kernel for versions less than 5.15.107.1-2

A use-after-free flaw was found in vhostnetsetbackend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem...

Important: kernel-livepatch-5.10.165-143.735

Issue Overview: The upstream bug report describes this issue as follows: A flaw found in the Linux Kernel in RDS Reliable Datagram Sockets protocol. The rdsrmzerocopycallback uses listentry on the head of a list causing a type confusion. Local user can trigger this with rdsmessageput. Type...

Amazon Linux 2 : dbus (ALAS-2023-2006)

The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2006 advisory. An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticate...

Amazon Linux 2 : systemd (ALAS-2023-2004)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2004 advisory. systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files ...

Amazon Linux 2 : vim (ALAS-2023-2005)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2005 advisory. A heap-based buffer overflow vulnerability was found in GitHub repository vim/vim prior to 9.0.1376 in Vim's utfptr2char function of the src/mbyte.c file. This flaw occurs because there is access...

Amazon Linux 2 : xstream (ALAS-2023-2007)

The version of xstream installed on the remote host is prior to 1.3.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2007 advisory. XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the...

Amazon Linux 2 : booth (ALAS-2023-2009)

The version of booth installed on the remote host is prior to 1.0-8.ef769ef.git. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2009 advisory. The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to...

Amazon Linux 2 : python-twisted-web (ALAS-2023-2008)

The version of python-twisted-web installed on the remote host is prior to 12.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2008 advisory. Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does no...

CVE-2023-27491

A flaw was found in Envoy that may allow attackers to send specially crafted HTTP/2 or HTTP/3 requests to trigger parsing errors on the upstream HTTP/1 service...

[SECURITY] [DLA 3381-1] ghostscript security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3381-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb April 04, 2023 https://wiki.debian.org/LTS -...

Medium: gstreamer-plugins-good

Issue Overview: GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files. CVE-2021-3497 Affected Packages: gstreamer-plugins-good Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for...

PT-2023-11776

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to 2.x.x Description The issue allows a remote attacker to execute arbitrary code via the unserialize function. Note that the information about version 3.1.3 has been disputed by third parties as incomplete and...

Upgraded Q -> 2 from #44 [1680620528235]

Judge has assessed an item in Issue 44 as 2 risk. The relevant finding follows: Low 1 RescueTokens doesn't have checks for fee0 & fee1 tokens. Admin might accidentally withdraw fee tokens that are supposed to be for the stakers: --- The text was updated successfully, but these errors were...

Medium: vim

Issue Overview: A heap-based buffer overflow vulnerability was found in GitHub repository vim/vim prior to 9.0.1376 in Vim's utfptr2char function of the src/mbyte.c file. This flaw occurs because there is access to invalid memory with put in visual block mode. An attacker can trick a user into...

Medium: babel

Issue Overview: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files containing serialized Python objects via directory traversal, leading to code execution. CVE-2021-42771 Affected Packages: babel Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Medium: booth

Issue Overview: The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster. CVE-2022-2553...

CVE-2023-26750

Summary of CVE-2023-26750 : Yii 2 Framework prior to 2.0.47 contains a SQL injection vulnerability in the runAction function that can allow a remote attacker to execute arbitrary code. The issue’s impact is described as critical. Remediation available: upgrade to Yii 2.0.47 or later. Some connect...