Important: php

Issue Overview: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid...

Medium: php

Issue Overview: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip files, resulting in an infinite loop. CVE-2022-31628 In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to...

Amazon Linux 2 : php (ALASPHP8.0-2023-007)

The version of php installed on the remote host is prior to 8.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.0-2023-007 advisory. A flaw was found in PHP. The vulnerability occurs due to the malformed phpfilterfloat function and leads to a use-after-free...

Amazon Linux 2 : php (ALASPHP8.0-2023-008)

The version of php installed on the remote host is prior to 8.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-008 advisory. Several flaws has been found in php. The pdofirebase module does not check the length of the server version string in a...

Amazon Linux 2 : php (ALASPHP8.0-2023-004)

The version of php installed on the remote host is prior to 8.0.25-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-004 advisory. In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont function in gd extension, it is possible to...

Amazon Linux 2 : php (ALASPHP8.0-2023-005)

The version of php installed on the remote host is prior to 8.0.24-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-005 advisory. In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip...

Amazon Linux 2 : php (ALASPHP8.2-2023-001)

The version of php installed on the remote host is prior to 8.2.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2023-001 advisory. 2023-09-14: CVE-2023-0568 was added to this advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before...

Amazon Linux 2 : php (ALASPHP8.0-2023-003)

The version of php installed on the remote host is prior to 8.0.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.0-2023-003 advisory. A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly...

Medium: php

Issue Overview: Several flaws has been found in php. The pdofirebase module does not check the length of the server version string in a response packet causing a stack buffer overflow, does not verify the data and uses the wrong type to cast length leading to a crash, and does not validate the...

Important: php

Issue Overview: A vulnerability was found in PHP due to an uninitialized array in pgqueryparams function. When using the Postgres database extension, supplying invalid parameters to the parameterized query may lead to PHP attempting to free memory, using uninitialized data as pointers. This flaw...

Amazon Linux AMI : python38 (ALAS-2023-1816)

The version of python38 installed on the remote host is prior to 3.8.5-1.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1816 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It...

Amazon Linux AMI : ruby20 (ALAS-2023-1824)

The version of ruby20 installed on the remote host is prior to 2.0.0.648-2.42. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1824 advisory. An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. ...

Amazon Linux AMI : poppler (ALAS-2023-1821)

The version of poppler installed on the remote host is prior to 0.26.5-43.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1821 advisory. In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service application crashes with...

Amazon Linux AMI : clamav (ALAS-2023-1820)

The version of clamav installed on the remote host is prior to 0.103.9-1.55. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1820 advisory. A vulnerability in the filesystem image parser for Hierarchical File System Plus HFS+ of ClamAV could allow an unauthenticated,...

Amazon Linux AMI : ca-certificates (ALAS-2023-1817)

The version of ca-certificates installed on the remote host is prior to 2018.2.22-65.1.31. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1817 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while...

Amazon Linux AMI : kernel (ALAS-2023-1819)

The version of kernel installed on the remote host is prior to 4.14.322-170.538. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1819 advisory. A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality...

Amazon Linux AMI : amazon-ssm-agent (ALAS-2023-1825)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1377.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1825 advisory. The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker t...

Amazon Linux AMI : krb5 (ALAS-2023-1818)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1818 advisory. lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because...

Amazon Linux AMI : poppler (ALAS-2023-1823)

The version of poppler installed on the remote host is prior to 0.26.5-43.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1823 advisory. Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service...

Amazon Linux 2 : krb5 (ALAS-2023-2225)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2225 advisory. lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because...