Amazon Linux 2 : kernel (ALAS-2023-2232)

The version of kernel installed on the remote host is prior to 4.14.322-244.539. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2232 advisory. A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentialit...

Amazon Linux 2023 : gdk-pixbuf2, gdk-pixbuf2-devel, gdk-pixbuf2-modules (ALAS2023-2023-341)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-341 advisory. GNOME GdkPixbuf aka GDK-PixBuf before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c compositeframe. This overflow is...

Amazon Linux 2 : rust (ALAS-2023-2223)

The version of rust installed on the remote host is prior to 1.68.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2223 advisory. Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to...

Amazon Linux 2023 : hwloc, hwloc-devel, hwloc-gui (ALAS2023-2023-335)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-335 advisory. An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. CVE-2022-47022 Tenable has extracted the...

Amazon Linux 2 : libtiff (ALAS-2023-2236)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2236 advisory. 2023-11-29: CVE-2023-0804 was added to this advisory. 2023-11-29: CVE-2023-0802 was added to this advisory. LibTIFF 4.4.0...

Amazon Linux 2 : qt5-qtsvg (ALAS-2023-2242)

The version of qt5-qtsvg installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2242 advisory. 2023-09-27: CVE-2021-3481 was added to this advisory. Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg...

Amazon Linux 2023 : avahi, avahi-autoipd, avahi-compat-howl (ALAS2023-2023-332)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-332 advisory. avahi-daemon denial of service can be caused by unprivileged users via DBus CVE-2023-1981 Tenable has extracted the preceding description block directly from the tested product security advisory. Note...

Amazon Linux 2 : ImageMagick (ALAS-2023-2239)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2239 advisory. An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c...

Amazon Linux 2 : hwloc (ALAS-2023-2237)

The version of hwloc installed on the remote host is prior to 1.11.8-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2237 advisory. An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via...

Amazon Linux 2 : OpenEXR (ALAS-2023-2241)

The version of OpenEXR installed on the remote host is prior to 1.7.1-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2241 advisory. There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted...

Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2023-340)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-340 advisory. An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an...

Amazon Linux 2 : compat-libtiff3 (ALAS-2023-2235)

The version of compat-libtiff3 installed on the remote host is prior to 3.9.4-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2235 advisory. LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-330)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-330 advisory. A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. CVE-2023-20588 The fix for XSA-423 added logic to Linux'es netback...

Amazon Linux 2 : sox, --advisory ALAS2-2023-2231 (ALAS-2023-2231)

The version of sox installed on the remote host is prior to 14.4.1-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2231 advisory. A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsxreadwbuf in formatsi.c file. The...

Amazon Linux 2023 : apache-ivy, apache-ivy-javadoc (ALAS2023-2023-336)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-336 advisory. Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior t...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-329)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-329 advisory. A NULL pointer dereference flaw was found in Libtiff's LZWDecode function in the libtiff/tiflzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2023-319)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-319 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authenticatio...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2023-339)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-339 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : binutils, binutils-devel, binutils-gprofng (ALAS2023-2023-334)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-334 advisory. Heap buffer overflow vulnerability in binutils readelf before 2.40 via function displaydebugsection in file readelf.c. CVE-2022-45703 An issue was discovered in Binutils addr2line before 2.39.3...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2023-322)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-322 advisory. IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or . If an...