Amazon Linux 2 : sysstat (ALAS-2023-2068)

The version of sysstat installed on the remote host is prior to 10.1.5-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2068 advisory. sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of ...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-190)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-190 advisory. An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved...

Amazon Linux 2 : dnsmasq (ALAS-2023-2069)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2069 advisory. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 becau...

Amazon Linux 2023 : byacc (ALAS2023-2023-204)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-204 advisory. When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory use after free. CVE-2021-33641 When a file is...

Amazon Linux 2023 : freetype, freetype-demos, freetype-devel (ALAS2023-2023-188)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-188 advisory. A segmentation fault was found in the FreeType library. This flaw allows an attacker to attempt access to a memory location in a way that could cause an application to halt or crash, leading to...

Amazon Linux 2023 : c-ares, c-ares-devel (ALAS2023-2023-198)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-198 advisory. A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cau...

Amazon Linux 2 : OpenEXR (ALAS-2023-2078)

The version of OpenEXR installed on the remote host is prior to 1.7.1-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2078 advisory. A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by...

Amazon Linux 2 : flatpak (ALAS-2023-2076)

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2076 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 a...

Amazon Linux 2 : libfastjson (ALAS-2023-2079)

The version of libfastjson installed on the remote host is prior to 0.99.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2079 advisory. A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write...

Amazon Linux 2023 : libtasn1, libtasn1-devel, libtasn1-tools (ALAS2023-2023-201)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-201 advisory. GNU Libtasn1 before 4.19.0 has an ETYPEOK off-by-one array size check that affects asn1encodesimpleder. CVE-2021-46848 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2 : xmlrpc (ALAS-2023-2080)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2080 advisory. An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC aka ws-xmlrpc library. A malicious XML-RPC server could target a XML-RPC clie...

Amazon Linux 2 : squid (ALAS-2023-2081)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2081 advisory. An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receivi...

Amazon Linux 2 : openssl (ALAS-2023-2073)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2073 advisory. A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509...

Amazon Linux 2 : glusterfs (ALAS-2023-2071)

The version of glusterfs installed on the remote host is prior to 3.12.2-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2071 advisory. In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. CVE-2023-26253...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-189)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-189 advisory. 2024-05-09: CVE-2022-33196 was added to this advisory. Insufficient granularity of access control in out-of-band management in some IntelR Atom and Intel Xeon Scalable Processors may allow a...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-194)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-194 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2610 Tenable has...

Amazon Linux 2023 : sysstat (ALAS2023-2023-191)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-191 advisory. sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. CVE-2023-33204 Tenable has extracte...

Amazon Linux 2023 : libcap, libcap-devel, libcap-static (ALAS2023-2023-195)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-195 advisory. libcap is vulnerable to a denial of service caused by the error handling in wrappthreadcreate function, which will cause memory to be leaked in the case of an error. CVE-2023-2602 Tenable has extracted...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-193)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-193 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and telnet options for the...

Amazon Linux 2023 : dnsmasq, dnsmasq-utils (ALAS2023-2023-192)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-192 advisory. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. CVE-2023-28450 Tenable has extracted the...