Amazon Linux 2 : LibRaw (ALAS-2023-2256)

The version of LibRaw installed on the remote host is prior to 0.19.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2256 advisory. Buffer Overflow vulnerability in LibRaw::stretch function in libraw\src\postprocessing\aspectratio.cpp. CVE-2020-22628 In...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2023-347)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-347 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-348)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-348 advisory. Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of servi...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-344)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-344 advisory. Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains...

Amazon Linux 2 : thunderbird (ALAS-2023-2248)

The version of thunderbird installed on the remote host is prior to 102.15.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2248 advisory. Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be...

Amazon Linux 2 : libtiff, --advisory ALAS2-2023-2263 (ALAS-2023-2263)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2263 advisory. The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service invalid read and...

Amazon Linux 2023 : docker (ALAS2023-2023-345)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-345 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now...

Medium: qt5-qtbase

Issue Overview: Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. CVE-2022-25634 An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion...

Amazon Linux 2023 : nasm, nasm-rdoff (ALAS2023-2023-354)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-354 advisory. A Segmentation Fault issue discovered in in ieeesegment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a denial of service via crafted assembly file. CVE-2020-21528...

Amazon Linux 2 : libjpeg-turbo (ALAS-2023-2254)

The version of libjpeg-turbo installed on the remote host is prior to 2.0.90-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2254 advisory. 2023-10-30: CVE-2020-17541 was added to this advisory. Libjpeg-turbo all version have a stack-based buffer overflow...

Medium: gsl

Issue Overview: A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing a maliciously crafted input data for gslstatsquantilefromsorteddata of the library may lead to unexpected application...

Important: thunderbird

Issue Overview: Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file...

Medium: elfutils

Issue Overview: The libcpu component which is used by libasm of elfutils version 0.177 git 47780c9e, suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write CWE-787, off-by-one error CWE-193 and reachable assertion CWE-617; to exploit the vulnerabilit...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2250)

The version of open-vm-tools installed on the remote host is prior to 12.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2250 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the- middle MITM network...

Amazon Linux 2 : libxml2 (ALAS-2023-2249)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2249 advisory. Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement function at /libxml2/SAX2.c...

Amazon Linux 2 : opensc (ALAS-2023-2262)

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2262 advisory. OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decodebitstring in libopensc/asn1.c...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-351)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-351 advisory. An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. CVE-2022-40090 Tenable has extracted the preceding...

Amazon Linux 2 : gsl (ALAS-2023-2255)

The version of gsl installed on the remote host is prior to 1.15-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2255 advisory. A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2....

Medium: php

Issue Overview: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly quoted string. With the implementation of sqlite3snprintf, it is possible to force the function to return a single apostrophe if the function is called...

Medium: php

Issue Overview: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly quoted string. With the implementation of sqlite3snprintf, it is possible to force the function to return a single apostrophe if the function is called...