Low: containerd

Issue Overview: Containerd is not affected by CVE-2023-39325. While it contains the affected module, it does not use it in a way that exposes users to CVE-2023-39325. Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Docker Extra. Visit this page to learn more...

Important: runc

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: runc Note: This advisory is applicable to Amazon Linux...

Medium: cups

Issue Overview: A vulnerability was found in OpenPrinting CUPS. The security flaw occurs due to failure in validating the length provided by an attacker-crafted CUPS document, possibly leading to a heap-based buffer overflow and code execution. CVE-2023-4504 Affected Packages: cups Note: This...

Medium: libtiff

Issue Overview: There exists one heap buffer overflow in TIFFmemcpy in tifunix.c in libtiff 4.0.10, which allows an attacker to cause a denial-of-service through a crafted tiff file. CVE-2020-18768 A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3...

Important: thunderbird

Issue Overview: Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: Critical CVE-2023-4863 Affected Packages: thunderbird Note: This advisory is applicable to...

Medium: java-17-amazon-corretto

Issue Overview: Memory corruption bug on JDK 21 and 20 when AVX-512 is enabled. CVE-2023-22025 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 20.0.2...

Medium: libX11

Issue Overview: libX11: out-of-bounds memory access in XkbReadKeySyms CVE-2023-43785 libX11: integer overflow in XCreateImage leading to a heap overflow. CVE-2023-43787 Affected Packages: libX11 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for th...

Medium: squid

Issue Overview: Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors. CVE-2018-19131 A memory leak was discovered in the way Squid handles SNMP denied queries. A remote attacker may use this flaw to exhaust the resources on the server...

Medium: libsepol

Issue Overview: The CIL compiler in SELinux 3.2 has a use-after-free in cilverifyclassperms called from cilverifyclasspermission and cilpreverifyhelper. CVE-2021-36084 The CIL compiler in SELinux 3.2 has a use-after-free in cilverifyclassperms called from verifymappermclassperms and hashtabmap...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-010)

The version of tomcat installed on the remote host is prior to 9.0.81-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2023-010 advisory. Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-016)

The version of tomcat installed on the remote host is prior to 8.5.94-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-016 advisory. Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from...

Amazon Linux 2 : ecs-init (ALASECS-2023-009)

The version of ecs-init installed on the remote host is prior to 1.76.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-009 advisory. No CVE was issued for this update. Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-016)

The version of firefox installed on the remote host is prior to 102.15.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2FIREFOX-2023-016 advisory. VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. CVE-2023-44488 Tenable has extracte...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-028)

The version of kernel installed on the remote host is prior to 5.15.134-87.145. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-028 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to...

Amazon Linux 2 : containerd (ALASECS-2023-008)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-008 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-041 (ALASKERNEL-5.10-2023-041)

The version of kernel installed on the remote host is prior to 5.10.197-186.748. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-041 advisory. A flaw was found in rsvpchange. The root cause is an slab-out-of-bound access, but since the offset to t...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-015)

The version of firefox installed on the remote host is prior to 102.15.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2FIREFOX-2023-015 advisory. Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bound...

Amazon Linux 2 : nginx (ALASNGINX1-2023-006)

The version of nginx installed on the remote host is prior to 1.22.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-006 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : golang (ALAS-2023-2313)

The version of golang installed on the remote host is prior to 1.20.10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2313 advisory. 2024-01-03: CVE-2023-39319 was added to this advisory. 2023-10-30: CVE-2023-39318 was added to this advisory. The...

Amazon Linux 2 : nghttp2 (ALAS-2023-2312)

The version of nghttp2 installed on the remote host is prior to 1.41.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2312 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...