Amazon Linux 2 : python-lxml (ALAS-2024-2620)

The version of python-lxml installed on the remote host is prior to 3.2.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2620 advisory. An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and...

Amazon Linux 2 : ghostscript (ALAS-2024-2614)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2614 advisory. Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in t...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-078)

The version of kernel installed on the remote host is prior to 5.4.275-189.375. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-078 advisory. A flaw was found in the smb client in the Linux kernel. A potential out-of-bounds error was seen in the...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-050 (ALASKERNEL-5.15-2024-050)

The version of kernel installed on the remote host is prior to 5.15.164-108.161. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-050 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a use-after-free...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-067)

The version of kernel installed on the remote host is prior to 5.10.216-204.855. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-067 advisory. In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify a...

Amazon Linux 2 : squid (ALAS-2024-2609)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2609 advisory. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI...

Amazon Linux 2 : nerdctl (ALAS-2024-2618)

The version of nerdctl installed on the remote host is prior to 1.7.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2618 advisory. 2024-08-28: CVE-2024-24790 was added to this advisory. A malicious HTTP sender can use chunk extensions to cause a receive...

Amazon Linux 2 : kernel (ALAS-2024-2613)

The version of kernel installed on the remote host is prior to 4.14.349-266.564. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2613 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlanroutev6outbound helper...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-014)

The version of tomcat installed on the remote host is prior to 9.0.91-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2024-014 advisory. Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processin...

Amazon Linux 2 : containerd (ALASDOCKER-2024-041)

The version of containerd installed on the remote host is prior to 1.7.20-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2024-041 advisory. 2024-08-27: CVE-2024-24790 was added to this advisory. 2024-08-14: CVE-2023-47108 was removed from this advisory...

Amazon Linux 2 : emacs (ALAS-2024-2608)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2608 advisory. In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30203 In Emacs before 29.3, LaTeX preview is...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-079)

The version of kernel installed on the remote host is prior to 5.4.274-187.369. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-079 advisory. In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleti...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-027)

The version of firefox installed on the remote host is prior to 115.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-027 advisory. A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-066 (ALASKERNEL-5.10-2024-066)

The version of kernel installed on the remote host is prior to 5.10.223-211.872. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-066 advisory. A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the functi...

Low: ca-certificates

Issue Overview: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from GLOBALTRUST. Certifi 2024.07.04 removes ro...

Important: dotnet6.0

Issue Overview: .NET and Visual Studio Denial of Service Vulnerability CVE-2024-38095 Affected Packages: dotnet6.0 Issue Correction: Run dnf update dotnet6.0 --releasever 2023.5.20240805 or dnf update --advisory ALAS2023-2024-685 --releasever 2023.5.20240805 to update your system. More informatio...

Important: dotnet8.0

Issue Overview: .NET Core and Visual Studio Denial of Service Vulnerability CVE-2024-30105 .NET and Visual Studio Remote Code Execution Vulnerability CVE-2024-35264 .NET and Visual Studio Denial of Service Vulnerability CVE-2024-38095 Affected Packages: dotnet8.0 Issue Correction: Run dnf update...

Medium: mod_http2

Issue Overview: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Affected Packages: modhttp2 Issue Correction: Run dnf update modhttp2 --releasever 2023.5.202408...

Medium: ghostscript

Issue Overview: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43 ghostpdl-10.03.1 NOTE:...

Medium: tpm2-tools

Issue Overview: tpm2-tools: arbitrary quote data may go undetected by tpm2checkquote CVE-2024-29038 tpm2-tools: pcr selection value is not compared with the attest CVE-2024-29039 Affected Packages: tpm2-tools Issue Correction: Run dnf update tpm2-tools --releasever 2023.5.20240805 or dnf update...