Amazon Linux 2 : glibc (ALAS-2023-2371)

The version of glibc installed on the remote host is prior to 2.26-57. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2371 advisory. 2023-12-14: CVE-2021-33574 was added to this advisory. The mqnotify function in the GNU C Library aka glibc has a...

Amazon Linux 2 : uriparser (ALAS-2023-2368)

The version of uriparser installed on the remote host is prior to 0.7.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2368 advisory. An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax. CVE-2021-46142...

Medium: wireshark

Issue Overview: A heap based buffer overflow in Wireshark's NetScreen file parser may lead to a local arbitrary code execution via a crafted capture file. CVE-2023-6175 Affected Packages: wireshark Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2023-004)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2OPENSSL-SNAPSAFE-2023-004 advisory. Issue summary: Generating excessively long X9.42 DH keys or checkingexcessively long X9.42 DH keys or...

Amazon Linux 2 : mailman (ALAS-2023-2370)

The version of mailman installed on the remote host is prior to 2.1.15-30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2370 advisory. In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for...

Amazon Linux 2 : gawk (ALAS-2023-2357)

The version of gawk installed on the remote host is prior to 4.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2357 advisory. A heap out-of-bounds read flaw was found in builtin.c in the gawk package which may result in a crash of the software. CVE-2023-4156...

Amazon Linux 2 : jettison (ALAS-2023-2363)

The version of jettison installed on the remote host is prior to 1.3.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2363 advisory. Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser is...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-031 (ALASKERNEL-5.15-2023-031)

The version of kernel installed on the remote host is prior to 5.15.139-93.147. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-031 advisory. In the Linux kernel, the following vulnerability has been resolved: llc: verify mac len before reading ma...

Amazon Linux 2 : libX11 (ALAS-2023-2356)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2356 advisory. A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to consum...

Amazon Linux 2 : squid (ALAS-2023-2354)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2354 advisory. Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through...

Amazon Linux 2 : python-wheel (ALAS-2023-2362)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2362 advisory. An issue discovered in Python Packaging Authority PyPA Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE-2022-40898 Tenable has...

Amazon Linux 2 : ecs-init (ALASECS-2023-020)

The version of ecs-init installed on the remote host is prior to 1.79.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-020 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : containerd (ALASECS-2023-027)

The version of containerd installed on the remote host is prior to 1.4.6-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-027 advisory. containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in...

Amazon Linux 2 : containerd (ALASECS-2023-026)

The version of containerd installed on the remote host is prior to 1.4.6-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-026 advisory. The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OC...

Amazon Linux 2 : containerd (ALASECS-2023-023)

The version of containerd installed on the remote host is prior to 1.4.13-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-023 advisory. A flaw was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-056)

The version of kernel installed on the remote host is prior to 5.4.259-173.361. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-056 advisory. 2024-06-06: CVE-2023-52477 was added to this advisory. A race condition between two functions, lmLogClose...

Amazon Linux 2 : containerd (ALASECS-2023-030)

The version of containerd installed on the remote host is prior to 1.4.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-030 advisory. A flaw was found in containerd. Access controls for the shim API socket verified that a connecting process had an effective UI...

Amazon Linux 2 : containerd (ALASECS-2023-024)

The version of containerd installed on the remote host is prior to 1.4.6-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-024 advisory. A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image...

Amazon Linux 2 : docker (ALASECS-2023-025)

The version of docker installed on the remote host is prior to 20.10.7-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-025 advisory. The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2023-034)

The version of containerd installed on the remote host is prior to 1.6.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-034 advisory. In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2...