Amazon Linux 2 : poppler (ALAS-2023-2075)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2075 advisory. A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service DoS via a...

Amazon Linux 2 : mod_auth_mellon (ALAS-2023-2077)

The version of modauthmellon installed on the remote host is prior to 0.14.0-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2077 advisory. A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker t...

Amazon Linux 2 : git (ALAS-2023-2072)

The version of git installed on the remote host is prior to 2.40.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2072 advisory. Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5,...

Amazon Linux 2 : flatpak (ALAS-2023-2076)

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2076 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 a...

Amazon Linux 2 : OpenEXR (ALAS-2023-2078)

The version of OpenEXR installed on the remote host is prior to 1.7.1-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2078 advisory. A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by...

Amazon Linux 2 : dnsmasq (ALAS-2023-2069)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2069 advisory. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 becau...

Amazon Linux 2 : curl (ALAS-2023-2070)

The version of curl installed on the remote host is prior to 8.0.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2070 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part of thi...

Amazon Linux 2 : sysstat (ALAS-2023-2068)

The version of sysstat installed on the remote host is prior to 10.1.5-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2068 advisory. sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of ...

Amazon Linux 2 : libfastjson (ALAS-2023-2079)

The version of libfastjson installed on the remote host is prior to 0.99.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2079 advisory. A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write...

Amazon Linux 2 : openssl (ALAS-2023-2073)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2073 advisory. A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509...

Amazon Linux 2 : squid (ALAS-2023-2081)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2081 advisory. An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receivi...

Amazon Linux 2 : xmlrpc (ALAS-2023-2080)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2080 advisory. An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC aka ws-xmlrpc library. A malicious XML-RPC server could target a XML-RPC clie...

Important: sysstat

Issue Overview: sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. CVE-2023-33204 Affected Packages: sysstat Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

Important: python-pillow

Issue Overview: Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed. CVE-2014-9601 Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted...

Important: squid

Issue Overview: An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker...

Important: xmlrpc

Issue Overview: An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC aka ws-xmlrpc library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintain...

Medium: mod_auth_mellon

Issue Overview: A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. T...

Important: glusterfs

Issue Overview: In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. CVE-2023-26253 Affected Packages: glusterfs Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between A...

Medium: rsync

Issue Overview: A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large gzip header extra field. This flaw is only applicable in the call inflateGetHeader. CVE-2022-37434 Affected Packages: rsync Note: This advisory is...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-033)

The version of kernel installed on the remote host is prior to 5.10.179-168.710. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-033 advisory. A denial of service problem was found, due to a possible recursive locking scenario, resulting in a...