Important: postgresql15

Issue Overview: Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted...

Amazon Linux 2 : glib2 (ALAS-2024-2487)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2487 advisory. An issue was discovered in GNOME GLib before 2.66.8. When gfilereplace is used with GFILECREATEREPLACEDESTINATION to replace a path...

Amazon Linux AMI : cpio (ALAS-2024-1925)

The version of cpio installed on the remote host is prior to 2.10-12.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1925 advisory. cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a...

Amazon Linux 2 : wpa_supplicant (ALAS-2024-2480)

The version of wpasupplicant installed on the remote host is prior to 2.6-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2480 advisory. wpasupplicant: potential authorization bypass CVE-2023-52160 Tenable has extracted the preceding description block directly fr...

Amazon Linux 2 : kernel (ALAS-2024-2475)

The version of kernel installed on the remote host is prior to 4.14.336-257.562. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2475 advisory. 2024-07-03: CVE-2024-23851 was added to this advisory. dmtablecreate in drivers/md/dm-table.c in the Linux kernel...

Amazon Linux 2 : cpio (ALAS-2024-2489)

The version of cpio installed on the remote host is prior to 2.12-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2489 advisory. cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a fil...

Amazon Linux 2 : unbound (ALAS-2024-2481)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2481 advisory. Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of servi...

Amazon Linux 2 : xerces-c (ALAS-2024-2476)

The version of xerces-c installed on the remote host is prior to 3.1.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2476 advisory. Apache issued this CVE to indicate the correct versions of xerces-c, which included the fix for CVE-2018-1311. See the older CVE...

Amazon Linux 2 : curl (ALAS-2024-2490)

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2490 advisory. This update enables libpsl support in curl, which adds protection against domain spanning super cookies as described in section 5.3 of...

Amazon Linux 2 : less (ALAS-2024-2485)

The version of less installed on the remote host is prior to 458-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2485 advisory. closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE. CVE-2022-48624 Tenable has extracted the preceding...

Amazon Linux AMI : kernel (ALAS-2024-1923)

The version of kernel installed on the remote host is prior to 4.14.336-180.562. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1923 advisory. A flaw was found in the ATA over Ethernet AoE driver in the Linux kernel. The aoecmdcfgpkts function improperly...

Amazon Linux 2 : glade (ALAS-2024-2488)

The version of glade installed on the remote host is prior to 3.22.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2488 advisory. plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox,...

Amazon Linux AMI : less (ALAS-2024-1924)

The version of less installed on the remote host is prior to 436-13.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1924 advisory. closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE. CVE-2022-48624 Tenable has extracted the precedin...

Amazon Linux 2 : shim (ALAS-2024-2484)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2484 advisory. A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious...

Amazon Linux 2 : libuv (ALAS-2024-2474)

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2474 advisory. libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and...

Amazon Linux 2 : thunderbird (ALAS-2024-2477)

The version of thunderbird installed on the remote host is prior to 115.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2477 advisory. When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting ...

Important: perl-Cpanel-JSON-XS

Issue Overview: The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service. CVE-2022-48623 Affected Packages: perl-Cpanel-JSON-XS Issue Correction: Run dnf update perl-Cpanel-JSON-XS...

Amazon Linux 2 : openssl11 (ALAS-2024-2478)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2478 advisory. Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack The...

Amazon Linux 2 : openssl (ALAS-2024-2479)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2479 advisory. Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack The...

Important: composer

Issue Overview: Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead...