Medium: yajl

Issue Overview: There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash. CVE-2023-33460 Affected Packages: yajl Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the differen...

Medium: ruby

Issue Overview: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in matchat during regular expression searching. A logical error involving order of validation and access in matchat could...

Important: ca-certificates

Issue Overview: An initial fix in Amazon Linux ca-certificates package relating to CVE-2022-23491 did not properly remove root certificates from TrustCor from the root store. CVE-2023-32803 Affected Packages: ca-certificates Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

Important: golist

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2023-2154)

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2154 advisory. Integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the...

Amazon Linux 2 : iperf3 (ALAS-2023-2153)

The version of iperf3 installed on the remote host is prior to 3.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2153 advisory. iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. CVE-2023-38403 Tenable...

Amazon Linux 2 : thunderbird (ALAS-2023-2156)

The version of thunderbird installed on the remote host is prior to 102.13.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2156 advisory. An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This...

Amazon Linux 2 : apache-ivy (ALAS-2023-2165)

The version of apache-ivy installed on the remote host is prior to 2.3.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2165 advisory. When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied pattern...

Amazon Linux 2 : libvncserver (ALAS-2023-2170)

The version of libvncserver installed on the remote host is prior to 0.9.9-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2170 advisory. libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup. CVE-2020-29260 Tenable has...

Amazon Linux 2 : golang (ALAS-2023-2163)

The version of golang installed on the remote host is prior to 1.20.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2163 advisory. RESERVEDNOTE: https://groups.google.com/g/golang-announce/c/V0aBFqaFsE CVE-2022-41724 Golang: net/http, mime/multipart:...

Amazon Linux 2 : libicu60 (ALAS-2023-2172)

The version of libicu60 installed on the remote host is prior to 60.3-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2172 advisory. International Components for Unicode ICU-20850 v66.1 was discovered to contain a use after free bug in the pkgcreateWithAssemblyCod...

Amazon Linux 2 : scipy (ALAS-2023-2160)

The version of scipy installed on the remote host is prior to 0.12.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2160 advisory. A use-after-free issue was discovered in PyFindObjects function in SciPy versions prior to 1.8.0. CVE-2023-29824 Tenable has extract...

Amazon Linux 2 : bluez (ALAS-2023-2167)

The version of bluez installed on the remote host is prior to 5.44-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2167 advisory. A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially...

Amazon Linux 2 : keepalived (ALAS-2023-2168)

The version of keepalived installed on the remote host is prior to 1.3.5-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2168 advisory. A flaw was found in keepalived, where an improper authentication vulnerability allows an unprivileged user to change properties...

Amazon Linux 2 : avahi (ALAS-2023-2161)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2161 advisory. avahi-daemon denial of service can be caused by unprivileged users via DBus CVE-2023-1981 Tenable has extracted the preceding...

Amazon Linux 2 : SDL2 (ALAS-2023-2162)

The version of SDL2 installed on the remote host is prior to 2.0.10-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2162 advisory. A memory leak issue was discovered in SDL2 version = SDL2-2.0.8. CVE-2022-4743 Tenable has extracted the preceding description block...

Amazon Linux 2 : compat-libtiff3 (ALAS-2023-2157)

The version of compat-libtiff3 installed on the remote host is prior to 3.9.4-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2157 advisory. Memory leak in memory leak in tiffcrop.c. CVE-2023-3576 Tenable has extracted the preceding description block directly fro...

Amazon Linux 2 : python-mako (ALAS-2023-2164)

The version of python-mako installed on the remote host is prior to 0.8.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2164 advisory. Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This al...

Amazon Linux 2 : python-ipaddress (ALAS-2023-2174)

The version of python-ipaddress installed on the remote host is prior to 1.0.16-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2174 advisory. A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and...

Amazon Linux 2 : libtiff (ALAS-2023-2158)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2158 advisory. Memory leak in memory leak in tiffcrop.c. CVE-2023-3576 Tenable has extracted the preceding description block directly from the...