Amazon Linux 2 : mod_auth_mellon (ALAS-2023-2077)

The version of modauthmellon installed on the remote host is prior to 0.14.0-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2077 advisory. A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker t...

Amazon Linux 2023 : perl-CPAN, perl-CPAN-tests (ALAS2023-2023-182)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-182 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Tenable has...

Amazon Linux 2 : git (ALAS-2023-2072)

The version of git installed on the remote host is prior to 2.40.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2072 advisory. Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5,...

Amazon Linux 2 : rsync (ALAS-2023-2074)

The version of rsync installed on the remote host is prior to 3.1.2-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2074 advisory. A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large...

Amazon Linux 2 : poppler (ALAS-2023-2075)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2075 advisory. A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service DoS via a...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-199)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-199 advisory. RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file CVE-2023-1992 LISP dissector large loop in Wiresha...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-206)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-206 advisory. An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2023-186)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-186 advisory. A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service. CVE-2023-1667 A vulnerability...

Amazon Linux 2023 : snakeyaml, snakeyaml-javadoc (ALAS2023-2023-200)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-200 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser t...

Amazon Linux 2 : python-pillow (ALAS-2023-2083)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2083 advisory. Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in ...

Amazon Linux 2023 : ldb-tools, libldb, libldb-devel (ALAS2023-2023-187)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-187 advisory. Access controlled AD LDAP attributes can be discovered CVE-2023-0614 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-197)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-197 advisory. Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version between 4.0.0 to 4.0.5, by default, is susceptible to a heap-based buffer overflow, and...

Amazon Linux 2023 : gnuplot-common, gnuplot-latex, gnuplot-minimal (ALAS2023-2023-202)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-202 advisory. A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash. CVE-2021-44917 Tenable has extracted the...

Amazon Linux 2 : pcre (ALAS-2023-2082)

The version of pcre installed on the remote host is prior to 8.32-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2082 advisory. PCRE before 8.38 mishandles the : and \ substrings in character classes, which allows remote attackers to cause a denial of...

Amazon Linux 2023 : libwebp, libwebp-devel, libwebp-java (ALAS2023-2023-185)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-185 advisory. A double-free in libwebp could have led to memory corruption and a potentially exploitable crash. CVE-2023-1999 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : cloud-init (ALAS2023-2023-196)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-196 advisory. Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. CVE-2023-1786 Tenable...

Amazon Linux 2023 : libwayland-client, libwayland-cursor, libwayland-egl (ALAS2023-2023-203)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-203 advisory. An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the...

Amazon Linux 2023 : byacc (ALAS2023-2023-204)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-204 advisory. When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory use after free. CVE-2021-33641 When a file is...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-190)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-190 advisory. An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved...

Amazon Linux 2 : libfastjson (ALAS-2023-2079)

The version of libfastjson installed on the remote host is prior to 0.99.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2079 advisory. A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write...