Amazon Linux AMI : batik (ALAS-2023-1695)

The version of batik installed on the remote host is prior to 1.7-10.10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1695 advisory. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel...

Amazon Linux 2 : cifs-utils (ALAS-2023-1978)

The version of cifs-utils installed on the remote host is prior to 6.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1978 advisory. A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local...

Amazon Linux 2 : qt5-qtbase (ALAS-2023-1967)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1967 advisory. Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath called from...

Amazon Linux 2 : xorg-x11-server (ALAS-2023-1982)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1982 advisory. 2024-05-23: CVE-2022-46343 was added to this advisory. 2024-05-23: CVE-2022-46341 was added to this advisory. 2024-05-23: CVE-2022-46344 was added to this advisory. 2024-05-23: CVE-2022-46340 was...

Amazon Linux 2 : thunderbird (ALAS-2023-1983)

The version of thunderbird installed on the remote host is prior to 102.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1983 advisory. 2024-02-15: CVE-2023-0616 was added to this advisory. If a MIME email combines OpenPGP and OpenPGP MIME data in a...

Amazon Linux 2 : emacs (ALAS-2023-1981)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1981 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, becau...

Amazon Linux 2 : freeradius (ALAS-2023-1970)

The version of freeradius installed on the remote host is prior to 3.0.26-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1970 advisory. The EAP-PWD function computepasswordelement leaks information about the password which allows an attacker to...

Amazon Linux 2 : python (ALAS-2023-1980)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1980 advisory. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing som...

Amazon Linux 2 : git (ALAS-2023-1984)

The version of git installed on the remote host is prior to 2.39.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1984 advisory. Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5,...

Amazon Linux AMI : cifs-utils (ALAS-2023-1698)

The version of cifs-utils installed on the remote host is prior to 6.2-7.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1698 advisory. A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local...

Medium: python2-setuptools

Issue Overview: Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service ReDoS in packageindex.py. CVE-2022-40897 Affected Packages:...

Important: thunderbird

Issue Overview: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacker could send a crafted messa...

Amazon Linux 2 : snakeyaml (ALAS-2023-1976)

The version of snakeyaml installed on the remote host is prior to 1.11-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1976 advisory. The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitati...

Amazon Linux 2 : python2-setuptools (ALAS-2023-1979)

The version of python2-setuptools installed on the remote host is prior to 41.2.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1979 advisory. Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML ...

Medium: cpio

Issue Overview: GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the ...

Important: libdb

Issue Overview: Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DBCONFIG in the current directory...

Important: snakeyaml

Issue Overview: The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections. CVE-2022-25857 Affected Packages: snakeyaml Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

Medium: ImageMagick

Issue Overview: An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum function in MagickCore/quantum-export.c. Function calls to GetPixelIndex could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file,...

Important: xorg-x11-server

Issue Overview: A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems...

Important: batik

Issue Overview: Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...