Amazon Linux 2 : docker (ALASDOCKER-2023-024)

The version of docker installed on the remote host is prior to 20.10.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-024 advisory. A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the...

Amazon Linux 2 : mysql-connector-java (ALAS-2023-2017)

The version of mysql-connector-java installed on the remote host is prior to 5.1.25-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2017 advisory. Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are...

Amazon Linux 2 : emacs (ALAS-2023-2012)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2012 advisory. org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a fi...

Important: emacs

Issue Overview: org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters. CVE-2023-28617 Affected Packages: emacs Note: This advisory is applicable to Amazon...

Amazon Linux 2 : jasper (ALAS-2023-2018)

The version of jasper installed on the remote host is prior to 1.900.1-33. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2018 advisory. A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper, causi...

Amazon Linux 2 : pki-core (ALAS-2023-2016)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2016 advisory. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending...

Amazon Linux 2 : golang, --advisory ALAS2-2023-2015 (ALAS-2023-2015)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2015 advisory. Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparseable...

Amazon Linux 2 : liblouis (ALAS-2023-2013)

The version of liblouis installed on the remote host is prior to 2.6.2-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2013 advisory. Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the...

Amazon Linux 2 : ImageMagick (ALAS-2023-2014)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2014 advisory. A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation...

Important: jasper

Issue Overview: A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper, causing an arbitrary out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2020-27828 ...

Important: liblouis

Issue Overview: Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the loulogFile function at logginc.c endpoint. CVE-2023-26767 Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-030)

The version of kernel installed on the remote host is prior to 5.10.29-27.126. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2023-030 advisory. An issue was discovered in fs/iouring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial o...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-016 (ALASKERNEL-5.15-2023-016)

The version of kernel installed on the remote host is prior to 5.15.106-64.140. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-016 advisory. A flaw was found in the Linux kernel Traffic Control TC subsystem. Using a specific networking...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-029 (ALASKERNEL-5.10-2023-029)

The version of kernel installed on the remote host is prior to 5.10.177-158.645. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-029 advisory. A use-after-free vulnerability was found in nfs42sscopen in fs/nfs/nfs4file.c in the Linux kernel. This...

Important: kernel-livepatch-5.10.173-154.642

Issue Overview: dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference. CVE-2023-28466 Affected Packages: kernel-livepatch-5.10.173-154.642 Issue Correction: Please ensur...

Important: kernel-livepatch-5.10.167-147.601

Issue Overview: kernel: Type confusion in picknextrtentity, which can result in memory corruption. CVE-2023-1077 dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2023-023)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-023 advisory. containerd is an open source container runtime. A bug was found in containerd's CRI implementation where ...

Amazon Linux 2 : containerd (ALASDOCKER-2023-023)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-023 advisory. containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user c...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2023-022)

The version of docker installed on the remote host is prior to 20.10.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-022 advisory. A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw i...

Amazon Linux 2 : docker (ALASDOCKER-2023-022)

The version of docker installed on the remote host is prior to 20.10.23-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-022 advisory. A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the...