Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-057)

The version of kernel installed on the remote host is prior to 5.4.265-176.364. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-057 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: double hook...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-018)

The version of firefox installed on the remote host is prior to 115.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-018 advisory. The WebGL DrawElementsInstanced method was susceptible to a heap buffer overflow when used on systems with the Mes...

Amazon Linux 2 : djvulibre (ALASMATE-DESKTOP1.X-2024-005)

The version of djvulibre installed on the remote host is prior to 3.5.27-30. It is, therefore, affected by a vulnerability as referenced in the ALAS2MATE-DESKTOP1.X-2024-005 advisory. An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service...

Amazon Linux 2 : libpq (ALASPOSTGRESQL12-2024-006)

The version of libpq installed on the remote host is prior to 12.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL12-2024-006 advisory. 2024-06-06: CVE-2023-5869 was removed from this advisory.2024-06-06: The severity of this advisory was modified from...

Amazon Linux 2 : bluez (ALAS-2024-2386)

The version of bluez installed on the remote host is prior to 5.44-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2386 advisory. bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution CVE-2023-45866 Tenable has...

Amazon Linux 2 : ncurses (ALAS-2024-2380)

The version of ncurses installed on the remote host is prior to 6.0-8.20170212. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2380 advisory. NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component ncwrapentry. CVE-2023-50495 Tenable ha...

Amazon Linux 2 : vim (ALAS-2024-2384)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2384 advisory. Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very first time and using a sub-replace-special atom inside the...

Amazon Linux 2 : avahi (ALAS-2024-2392)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2392 advisory. A reachable assertion was found in avahialternativehostname. CVE-2023-38473 Tenable has extracted the preceding description block...

Amazon Linux 2 : virtuoso-opensource (ALAS-2024-2383)

The version of virtuoso-opensource installed on the remote host is prior to 7.2.11-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2383 advisory. An issue in the boxdiv function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-033 (ALASKERNEL-5.15-2024-033)

The version of kernel installed on the remote host is prior to 5.15.145-95.156. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-033 advisory. An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an...

Amazon Linux 2 : ntp (ALAS-2024-2396)

The version of ntp installed on the remote host is prior to 4.2.8p15-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2396 advisory. 2024-02-15: CVE-2023-26555 was added to this advisory. mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds wri...

Amazon Linux 2 : thunderbird (ALAS-2024-2379)

The version of thunderbird installed on the remote host is prior to 115.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2379 advisory. On some systems--depending on the graphics settings and drivers--it was possible to force an out-of-bounds read and...

Amazon Linux 2 : ecs-init (ALASECS-2024-031)

The version of ecs-init installed on the remote host is prior to 1.79.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-031 advisory. Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This...

Amazon Linux 2 : xmlgraphics-commons (ALAS-2024-2411)

The version of xmlgraphics-commons installed on the remote host is prior to 1.5-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2411 advisory. Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input...

Amazon Linux 2 : libuv (ALAS-2024-2410)

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2410 advisory. Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii is used to convert strings to ASCI...

Amazon Linux 2 : resteasy-base (ALAS-2024-2398)

The version of resteasy-base installed on the remote host is prior to 3.0.6-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2398 advisory. A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are...

Amazon Linux 2 : libsndfile (ALAS-2024-2404)

The version of libsndfile installed on the remote host is prior to 1.0.25-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2404 advisory. Multiple signed integers overflow in function aureadheader in src/au.c and in functions mat4open and mat4readheader in...

Amazon Linux 2 : binutils (ALAS-2024-2401)

The version of binutils installed on the remote host is prior to 2.29.1-31. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2401 advisory. A memory consumption issue in getdata function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denia...

Amazon Linux 2 : jetty (ALAS-2024-2408)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2408 advisory. For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example...

Amazon Linux 2 : openssh (ALAS-2023-2376)

The version of openssh installed on the remote host is prior to 7.4p1-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2376 advisory. AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A...