Amazon Linux 2 : libarchive (ALAS-2023-2374)

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2374 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists,...

Amazon Linux 2 : kernel (ALAS-2023-2359)

The version of kernel installed on the remote host is prior to 4.14.330-250.540. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2359 advisory. 2024-12-05: CVE-2023-52868 was added to this advisory. 2024-12-05: CVE-2023-52867 was added to this advisory...

Amazon Linux 2 : indent (ALAS-2023-2358)

The version of indent installed on the remote host is prior to 2.2.11-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2358 advisory. GNU indent 2.2.13 has a heap-based buffer overflow in searchbrace in indent.c via a crafted file. CVE-2023-40305 Tenable has...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2023-004)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2OPENSSL-SNAPSAFE-2023-004 advisory. Issue summary: Generating excessively long X9.42 DH keys or checkingexcessively long X9.42 DH keys or...

Amazon Linux 2 : gawk (ALAS-2023-2357)

The version of gawk installed on the remote host is prior to 4.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2357 advisory. A heap out-of-bounds read flaw was found in builtin.c in the gawk package which may result in a crash of the software. CVE-2023-4156...

Amazon Linux 2 : dovecot (ALAS-2023-2365)

The version of dovecot installed on the remote host is prior to 2.2.36-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2365 advisory. An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist wi...

Amazon Linux 2 : python-wheel (ALAS-2023-2362)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2362 advisory. An issue discovered in Python Packaging Authority PyPA Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE-2022-40898 Tenable has...

Amazon Linux 2 : avahi (ALAS-2023-2372)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2372 advisory. A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi...

Amazon Linux 2 : python-pip (ALAS-2023-2349)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2349 advisory. When installing a package from a Mercurial VCS URL ie pip installhg+... with pip prior to v23.3, the specified Mercurial revision couldbe used to inject arbitrary configuration options to the hg clonecall...

Amazon Linux 2 : vim (ALAS-2023-2353)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2353 advisory. Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be...

Amazon Linux 2 : squid (ALAS-2023-2354)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2354 advisory. Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through...

Amazon Linux 2 : binutils (ALAS-2023-2373)

The version of binutils installed on the remote host is prior to 2.29.1-31. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2373 advisory. An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangletype in...

Amazon Linux 2 : openssl (ALAS-2023-2350)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2350 advisory. Issue summary: Generating excessively long X9.42 DH keys or checkingexcessively long X9.42 DH keys or parameters may be very slow...

Amazon Linux 2 : jettison (ALAS-2023-2363)

The version of jettison installed on the remote host is prior to 1.3.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2363 advisory. Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser is...

Amazon Linux 2 : virtuoso-opensource (ALAS-2023-2360)

The version of virtuoso-opensource installed on the remote host is prior to 7.2.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2360 advisory. 2024-03-13: CVE-2023-31618 was added to this advisory. 2024-03-13: CVE-2023-31627 was added to this advisory...

Amazon Linux 2 : gstreamer1-plugins-bad-free (ALAS-2023-2355)

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2355 advisory. gstreamer: AV1 codec parser heap-based buffer overflow CVE-2023-44429 gstreamer: MXF demuxer...

Amazon Linux 2 : uriparser (ALAS-2023-2368)

The version of uriparser installed on the remote host is prior to 0.7.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2368 advisory. An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax. CVE-2021-46142...

Amazon Linux 2 : glibc (ALAS-2023-2371)

The version of glibc installed on the remote host is prior to 2.26-57. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2371 advisory. 2023-12-14: CVE-2021-33574 was added to this advisory. The mqnotify function in the GNU C Library aka glibc has a...

Amazon Linux 2 : ecs-init (ALASECS-2023-020)

The version of ecs-init installed on the remote host is prior to 1.79.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-020 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : containerd (ALASECS-2023-026)

The version of containerd installed on the remote host is prior to 1.4.6-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-026 advisory. The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OC...