Amazon Linux 2 : ctags (ALAS-2023-2343)

The version of ctags installed on the remote host is prior to 5.8-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2343 advisory. A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filename. A crafted tag filenam...

Amazon Linux 2 : vim (ALAS-2023-2338)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2338 advisory. Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function gagrowinner in in the file src/alloc.c at line 748, which is freed in the file...

Amazon Linux 2 : re2c (ALAS-2023-2344)

The version of re2c installed on the remote host is prior to 3.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2344 advisory. A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/deadrules.cc. CVE-2022-23901 Tenable has extracted the...

Amazon Linux 2 : qt5-qtimageformats (ALAS-2023-2337)

The version of qt5-qtimageformats installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2337 advisory. Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of...

Amazon Linux 2 : amazon-efs-utils (ALAS-2023-2342)

The version of amazon-efs-utils installed on the remote host is prior to 1.35.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2342 advisory. efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the...

Amazon Linux 2 : ruby (ALAS-2023-2345)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2345 advisory. A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service ReDoS during...

Amazon Linux 2 : python (ALAS-2023-2330)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2330 advisory. An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations ...

Amazon Linux 2 : httpd (ALAS-2023-2322)

The version of httpd installed on the remote host is prior to 2.4.58-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2322 advisory. Out-of-bounds Read vulnerability in modmacro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57...

Amazon Linux 2 : golist (ALAS-2023-2326)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2326 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2329)

The version of open-vm-tools installed on the remote host is prior to 12.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2329 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest...

Amazon Linux 2 : cri-tools (ALAS-2023-2324)

The version of cri-tools installed on the remote host is prior to 1.26.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2324 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : nautilus (ALAS-2023-2331)

The version of nautilus installed on the remote host is prior to 3.26.3.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2331 advisory. GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive. CVE-2022-3729...

Amazon Linux 2 : libxml2 (ALAS-2023-2321)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2321 advisory. libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNo...

Amazon Linux 2 : cni-plugins (ALAS-2023-2325)

The version of cni-plugins installed on the remote host is prior to 1.2.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2325 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : vim (ALAS-2023-2319)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2319 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. CVE-2023-5441 Use After Free in GitHub repository vim/vim prior to v9.0.2010. CVE-2023-553...

Amazon Linux 2 : libguestfs-winsupport (ALAS-2023-2332)

The version of libguestfs-winsupport installed on the remote host is prior to 7.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2332 advisory. An invalid return code in fusekernmount enables intercepting of libfuse-lite protocol traffic between NTFS-3G...

Amazon Linux 2 : zlib (ALAS-2023-2320)

The version of zlib installed on the remote host is prior to 1.2.7-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2320 advisory. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long...

Amazon Linux 2 : opensc (ALAS-2023-2323)

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2323 advisory. Potential PIN bypass.When the token/card was plugged into the computer and authenticated from one process, it could be use...

Amazon Linux 2 : nmap (ALAS-2023-2333)

The version of nmap installed on the remote host is prior to 6.40-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2333 advisory. Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service stack consumption and application...

Amazon Linux 2 : kernel (ALAS-2023-2328)

The version of kernel installed on the remote host is prior to 4.14.327-246.539. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2328 advisory. 2024-07-03: CVE-2023-52574 was added to this advisory. 2024-06-06: CVE-2023-52567 was added to this advisory...