Amazon Linux 2 : libgovirt (ALAS-2023-2220)

The version of libgovirt installed on the remote host is prior to 0.3.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2220 advisory. Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A...

Amazon Linux 2 : exiv2 (ALAS-2023-2215)

The version of exiv2 installed on the remote host is prior to 0.27.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2215 advisory. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. ...

Amazon Linux 2 : log4j (ALAS-2022-1739)

The version of log4j installed on the remote host is prior to 1.2.17-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1739 advisory. A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code o...

Amazon Linux 2 : oniguruma (ALAS-2023-2217)

The version of oniguruma installed on the remote host is prior to 5.9.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2217 advisory. An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A...

Amazon Linux 2 : libtiff (ALAS-2023-2212)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2212 advisory. 2023-08-31: CVE-2022-2953 was added to this advisory. 2023-08-31: CVE-2022-2520 was added to this advisory. 2023-08-31:...

Amazon Linux 2 : cni-plugins (ALAS-2023-2208)

The version of cni-plugins installed on the remote host is prior to 1.2.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2208 advisory. 2023-08-31: CVE-2023-29406 was added to this advisory. The HTTP/1 client does not fully validate the contents of the...

Amazon Linux AMI : ghostscript (ALAS-2023-1801)

The version of ghostscript installed on the remote host is prior to 8.70-24.29. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1801 advisory. A buffer overflow flaw was found in base/gdevdevn.c:1973 in devnpcxwriterle in ghostscript. This issue may allow a local...

Amazon Linux 2 : amanda (ALAS-2023-2218)

The version of amanda installed on the remote host is prior to 3.3.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2218 advisory. An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The...

Amazon Linux 2 : containerd (ALASDOCKER-2023-029)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-029 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Large handshake records may cause panics...

Amazon Linux 2 : containerd (ALASDOCKER-2023-027)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2023-027 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can...

Amazon Linux AMI : kernel (ALAS-2023-1803)

The version of kernel installed on the remote host is prior to 4.14.322-170.535. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1803 advisory. A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw...

Amazon Linux 2 : wavpack (ALAS-2023-2213)

The version of wavpack installed on the remote host is prior to 4.60.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2213 advisory. A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL...

Amazon Linux AMI : php70-pecl-imagick (ALAS-2023-1813)

The version of php70-pecl-imagick installed on the remote host is prior to 3.4.4-1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1813 advisory. ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c...

Amazon Linux 2 : runc (ALASDOCKER-2023-026)

The version of runc installed on the remote host is prior to 1.1.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2023-026 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a...

Amazon Linux 2 : edk2 (ALAS-2023-2205)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2205 advisory. Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckexor EVPPKEYparamcheck to check a DH key or DH paramete...

Amazon Linux AMI : amanda (ALAS-2023-1808)

The version of amanda installed on the remote host is prior to 2.6.1p2-8.14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1808 advisory. An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation...

Amazon Linux AMI : transfig (ALAS-2023-1807)

The version of transfig installed on the remote host is prior to 3.2.7b-10.8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1807 advisory. 2024-06-07: CVE-2019-19797 was added to this advisory. An out-of-bounds write flaw was found in transfig in the way th...

Amazon Linux AMI : GraphicsMagick (ALAS-2023-1806)

The version of GraphicsMagick installed on the remote host is prior to 1.3.38-1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1806 advisory. 2024-02-14: CVE-2020-21679 was added to this advisory. Buffer Overflow vulnerability in WritePCXImage function in...

Amazon Linux 2 : qemu (ALAS-2023-2207)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2207 advisory. A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtiocryptohandlesymreq. The...

Amazon Linux 2 : tomcat (ALAS-2023-2216)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2216 advisory. A flaw was found in Apache Tomcat. The HTTP header parsing code used an approach to end-of-line EOL parsing that allowed some...