Amazon Linux 2 : krb5 (ALAS-2023-2225)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2225 advisory. lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because...

Amazon Linux 2 : cups (ALAS-2023-2228)

The version of cups installed on the remote host is prior to 1.6.3-51. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2228 advisory. An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2023-337)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-337 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2023-317)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-317 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client...

Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2023-321)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-321 advisory. lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs...

Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-320)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-320 advisory. ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw. CVE-2023-39978 Tenable has extracted the preceding description block directly from the test...

Amazon Linux 2 : poppler (ALAS-2023-2243)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2243 advisory. Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service...

Amazon Linux 2023 : file, file-devel, file-libs (ALAS2023-2023-333)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-333 advisory. File before 5.43 has an stack-based buffer over-read in filecopystr in funcs.c. NOTE: File is the name of an Open Source project. CVE-2022-48554 Tenable has extracted the preceding description block...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2023-323)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-323 advisory. Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archiv...

Amazon Linux 2 : LibRaw (ALAS-2023-2234)

The version of LibRaw installed on the remote host is prior to 0.19.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2234 advisory. In LibRaw, an out-of-bounds read vulnerability exists within the LibRaw::adobecopypixel function libraw\src\decoders\dng.c...

Amazon Linux 2023 : dmidecode (ALAS2023-2023-328)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-328 advisory. Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. CVE-2023-30630 Tenable has extracted the...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-327)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-327 advisory. An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to acces...

Amazon Linux 2 : cri-tools (ALAS-2023-2229)

The version of cri-tools installed on the remote host is prior to 1.26.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2229 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a...

Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2023-2238 (ALAS-2023-2238)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1377.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2238 advisory. A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fa...

Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2023-325)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-325 advisory. In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities...

Amazon Linux 2 : clamav (ALAS-2023-2233)

The version of clamav installed on the remote host is prior to 0.103.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2233 advisory. A vulnerability in the filesystem image parser for Hierarchical File System Plus HFS+ of ClamAV could allow an unauthenticated,...

Amazon Linux 2 : python3 (ALAS-2023-2222)

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2222 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primaril...

Amazon Linux 2 : ca-certificates (ALAS-2023-2224)

The version of ca-certificates installed on the remote host is prior to 2021.2.50-72. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2224 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while...

Amazon Linux 2023 : indent (ALAS2023-2023-318)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-318 advisory. GNU indent 2.2.13 has a heap-based buffer overflow in searchbrace in indent.c via a crafted file. CVE-2023-40305 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2 : qt5-qtbase (ALAS-2023-2227)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2227 advisory. QT-based clients may mismatch HSTS headers Strict-Transport-Security, which would prevent the client from switching to a secure...