Medium: amazon-ecr-credential-helper

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 Affected Packages: amazon-ecr-credential-helper Note: This advisory is...

Important: thunderbird

Issue Overview: Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 1...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2024-007)

The version of postgresql installed on the remote host is prior to 13.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL13-2024-007 advisory. Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary...

Amazon Linux 2 : redis (ALASREDIS6-2024-010)

The version of redis installed on the remote host is prior to 6.2.14-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2024-010 advisory. Denial-of-service due to unbounded pattern matching CVE-2024-31228 Lua library commands may be exploited by an...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2024-011)

The version of postgresql installed on the remote host is prior to 12.20-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL12-2024-011 advisory. Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name CVE-2024-39494 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between...

Medium: libtiff

Issue Overview: libtiff: NULL pointer dereference in tifdirinfo.c CVE-2024-7006 Affected Packages: libtiff Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum updat...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-070 (ALASKERNEL-5.10-2024-070)

The version of kernel installed on the remote host is prior to 5.10.226-214.879. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-070 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after...

Amazon Linux 2 : python38-setuptools (ALASPYTHON3.8-2024-012)

The version of python38-setuptools installed on the remote host is prior to 38.4.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2024-012 advisory. A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code...

Amazon Linux 2 : php (ALASPHP8.2-2024-005)

The version of php installed on the remote host is prior to 8.2.23-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.2-2024-005 advisory. In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-086 (ALASKERNEL-5.4-2024-086)

The version of kernel installed on the remote host is prior to 5.4.284-196.380. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-086 advisory. In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's...

Important: postgresql

Issue Overview: Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pgdump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack...

Important: golang

Issue Overview: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. CVE-2024-34155 Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a...

Important: libpq

Issue Overview: Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pgdump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack...

Amazon Linux 2 : systemd (ALAS-2024-2636)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2636 advisory. An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-029)

The version of firefox installed on the remote host is prior to 115.15.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-029 advisory. 2024-09-26: CVE-2024-7652 was added to this advisory. An error in the ECMA-262 specification relating to Async...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xen/events: close evtchn after mapping cleanup CVE-2024-26687 In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize CVE-2024-35807 Affected Packages: kernel...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xen/events: close evtchn after mapping cleanup CVE-2024-26687 In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize CVE-2024-35807 Affected Packages: kernel...

Amazon Linux 2 : microcode_ctl (ALAS-2024-2635)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2635 advisory. 2024-10-10: CVE-2024-22374 was added to this advisory. Improper isolation in some IntelR Processors stream cache...

Medium: ruby

Issue Overview: ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 Affected Packages: ruby Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update...