Amazon Linux 2 : runc (ALASDOCKER-2023-025)

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-025 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-019 (ALASKERNEL-5.15-2023-019)

The version of kernel installed on the remote host is prior to 5.15.104-63.140. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-019 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: block range must be validated...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-020)

The version of kernel installed on the remote host is prior to 5.15.110-70.143. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-020 advisory. A denial of service problem was found, due to a possible recursive locking scenario, resulting in a...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-046)

The version of kernel installed on the remote host is prior to 5.4.242-156.349. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2023-046 advisory. In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2023-004)

The version of java-11-openjdk installed on the remote host is prior to 11.0.19.0.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2023-004 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java S...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2023-024)

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-024 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions ...

Amazon Linux 2 : qemu (ALAS-2023-2060)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2060 advisory. An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits tx descriptors in...

Amazon Linux 2 : squid (ALAS-2023-2062)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2062 advisory. An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in...

Amazon Linux 2 : kernel (ALAS-2023-2050)

The version of kernel installed on the remote host is prior to 4.14.314-238.539. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2050 advisory. In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to...

Amazon Linux 2 : libtiff (ALAS-2023-2055)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2055 advisory. It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose at tifclose.c:131 called by...

Amazon Linux 2 : microcode_ctl (ALAS-2023-2056)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2056 advisory. 2024-05-09: CVE-2022-33196 was added to this advisory. Insufficient granularity of access control in out-of-band...

Amazon Linux 2 : squid (ALAS-2023-2065)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2065 advisory. An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP...

Amazon Linux 2 : tar (ALAS-2023-2064)

The version of tar installed on the remote host is prior to 1.26-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2064 advisory. paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed...

Amazon Linux 2 : glib2 (ALAS-2023-2058)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2058 advisory. A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged...

Amazon Linux 2 : thunderbird (ALAS-2023-2051)

The version of thunderbird installed on the remote host is prior to 102.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2051 advisory. In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to...

Amazon Linux 2 : squid (ALAS-2023-2063)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2063 advisory. An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the...

Amazon Linux 2 : squid (ALAS-2023-2066)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2066 advisory. Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed...

Amazon Linux 2 : jettison (ALAS-2023-2053)

The version of jettison installed on the remote host is prior to 1.3.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2053 advisory. An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in o...

Amazon Linux 2 : fribidi (ALAS-2023-2054)

The version of fribidi installed on the remote host is prior to 1.0.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2054 advisory. A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidicaprtltounicode function of the...

Amazon Linux 2 : golang (ALAS-2023-2052)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2052 advisory. html/template: improper sanitization of CSS values Angle brackets were not considered dangerous characters when inserted into CSS...