Amazon Linux 2 : openldap (ALAS-2023-1958)

The version of openldap installed on the remote host is prior to 2.4.44-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1958 advisory. In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend ...

Amazon Linux 2 : nss-util (ALAS-2023-1942)

The version of nss-util installed on the remote host is prior to 3.44.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1942 advisory. Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before...

Amazon Linux AMI : libconfuse (ALAS-2023-1692)

The version of libconfuse installed on the remote host is prior to 2.7-4.4. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1692 advisory. cfgtildeexpand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read. CVE-2022-40320 Tenable has extracted the precedi...

Amazon Linux AMI : clamav (ALAS-2023-1694)

The version of clamav installed on the remote host is prior to 0.103.8-1.52. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1694 advisory. Possible remote code execution vulnerability in the ClamAV HFS+ file parser. The issue affects ClamAV versions 1.0.0 an...

Amazon Linux 2 : ca-certificates (ALAS-2023-1957)

The version of ca-certificates installed on the remote host is prior to 2021.2.50-72. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1957 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2023-003)

The version of java-11-openjdk installed on the remote host is prior to 11.0.18.0.10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2023-003 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java ...

Amazon Linux 2 : glibc (ALAS-2023-1944)

The version of glibc installed on the remote host is prior to 2.26-37. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1944 advisory. A vulnerability was discovered in glibc where the LDPREFERMAP32BITEXEC environment variable is not ignored when running...

Amazon Linux AMI : kernel (ALAS-2023-1688)

The version of kernel installed on the remote host is prior to 4.14.262-135.486. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1688 advisory. 2024-04-30: CVE-2023-0047 was removed from this advisory rejected. 2024-02-01: CVE-2023-0047 was added to this...

Amazon Linux 2 : liblouis (ALAS-2023-1941)

The version of liblouis installed on the remote host is prior to 2.6.2-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1941 advisory. Liblouis 3.5.0 has a Segmentation fault in loulogPrint in logging.c. CVE-2018-11577 Liblouis 3.5.0 has a stack-based...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-042 (ALASKERNEL-5.4-2023-042)

The version of kernel installed on the remote host is prior to 5.4.231-137.341. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-042 advisory. A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol L2TP. A missing lock when clearing...

Amazon Linux AMI : mysql57 (ALAS-2023-1686)

The version of mysql57 installed on the remote host is prior to 5.7.41-1.18. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1686 advisory. 2023-06-07: CVE-2023-21963 was added to this advisory. Vulnerability in the MySQL Server product of Oracle MySQL...

Amazon Linux 2 : httpcomponents-client (ALAS-2023-1946)

The version of httpcomponents-client installed on the remote host is prior to 4.2.5-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1946 advisory. Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in reques...

Amazon Linux 2 : nss (ALAS-2023-1952)

The version of nss installed on the remote host is prior to 3.67.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1952 advisory. NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2023-1963)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.362.b08-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1963 advisory. Improve CORBA communication: CORBA deserialization can result in outbound network connections with data passed i...

Amazon Linux 2 : ghostscript (ALAS-2023-1947)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1947 advisory. A heap-based buffer over write vulnerability was found in GhostScript's lp8000printpage function in gdevlp8k.c file. An attacker...

Amazon Linux 2 : python-lxml (ALAS-2023-1956)

The version of python-lxml installed on the remote host is prior to 3.2.1-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1956 advisory. Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to condu...

Amazon Linux 2 : squid (ALAS-2023-1950)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1950 advisory. An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of...

Amazon Linux 2 : nss-softokn (ALAS-2023-1955)

The version of nss-softokn installed on the remote host is prior to 3.67.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1955 advisory. NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-P...

Amazon Linux 2 : nss-util (ALAS-2023-1954)

The version of nss-util installed on the remote host is prior to 3.67.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1954 advisory. NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

Critical: clamav

Issue Overview: Possible remote code execution vulnerability in the ClamAV HFS+ file parser. The issue affects ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. CVE-2023-20032 A possible remote information leak vulnerability in the DMG file parser. The issue affects...