Amazon Linux 2 : grub2 (ALAS-2023-2146)

The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2146 advisory. A flaw was found in grub 2, where a crafted 16-bit grayscale PNG image may lead to an out-of-bounds write. This flaw allows ...

Amazon Linux 2 : flatpak (ALAS-2023-2134)

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2134 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8,...

Amazon Linux 2023 : perl-HTTP-Daemon, perl-HTTP-Daemon-tests (ALAS2023-2023-247)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-247 advisory. HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-237)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-237 advisory. The use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-243)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-243 advisory. A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cau...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-253)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-253 advisory. libtiff 4.5.0 is vulnerable to Buffer Overflow in uvencode when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. CVE-2023-26966 Tenable has extracted the...

Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-249)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-249 advisory. The upstream bug report describes this issue as follows:A vulnerability was found in ImageMagick =7.1.1, where heap-based buffer overflow was found in coders/tiff.c. CVE-2023-3428 Tenable has extracted...

Amazon Linux 2 : lynx (ALAS-2023-2145)

The version of lynx installed on the remote host is prior to 2.8.9-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2145 advisory. Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials...

Amazon Linux AMI : c-ares (ALAS-2023-1780)

The version of c-ares installed on the remote host is prior to 1.17.2-1.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1780 advisory. A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allow...

Amazon Linux 2023 : libX11, libX11-common, libX11-devel (ALAS2023-2023-250)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-250 advisory. A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the...

Amazon Linux 2 : golang (ALAS-2023-2131)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2131 advisory. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2023-258)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-258 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-240)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-240 advisory. A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order,...

Amazon Linux 2 : gstreamer-plugins-base (ALAS-2023-2121)

The version of gstreamer-plugins-base installed on the remote host is prior to 0.10.36-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2121 advisory. Integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the...

Amazon Linux 2 : ImageMagick (ALAS-2023-2123)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2123 advisory. The upstream bug report describes this issue as follows:A vulnerability was found in ImageMagick =7.1.1, where heap-based...

Amazon Linux AMI : tomcat8 (ALAS-2023-1779)

The version of tomcat8 installed on the remote host is prior to 8.5.89-1.93. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1779 advisory. The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.8...

Amazon Linux 2 : protobuf-c (ALAS-2023-2142)

The version of protobuf-c installed on the remote host is prior to 1.0.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2142 advisory. protobuf-c before 1.4.1 has an unsigned integer overflow in parserequiredmember. CVE-2022-48468 Tenable has extracted the...

Amazon Linux 2 : qemu, --advisory ALAS2-2023-2148 (ALAS-2023-2148)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2148 advisory. A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including...

Amazon Linux 2 : webkitgtk4 (ALAS-2023-2141)

The version of webkitgtk4 installed on the remote host is prior to 2.38.5-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2141 advisory. Processing web content may lead to arbitrary code execution NOTE:...

Amazon Linux 2 : squashfs-tools (ALAS-2023-2152)

The version of squashfs-tools installed on the remote host is prior to 4.3-0.21.gitaae0aff4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2152 advisory. Integer overflow in the readfragmenttable4 function in unsquash-4.c in Squashfs and sasquatch allows...