Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-517)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-517 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling CVE-2023-52486 In the Linux kernel, the following...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2024-528)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-528 advisory. 2024-02-29: CVE-2023-45145 was added to this advisory. Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer...

Amazon Linux 2 : containerd (ALASDOCKER-2024-038)

The version of containerd installed on the remote host is prior to 1.6.28-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2024-038 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2024-536)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-536 advisory. Vim before 9.0.2142 has a stack-based buffer overflow because didsetlangmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions. CVE-2024-22667 Tenab...

Important: kernel

Issue Overview: A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The nftverdictinit function allows positive values as drop error within the hook verdict, and hence the nfhookslow function can cause a double...

Low: containerd

Issue Overview: Containerd is not affected by CVE-2023-39325. While it contains the affected module, it does not use it in a way that exposes users to CVE-2023-39325. Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Docker Extra. Visit this page to learn more...

Amazon Linux 2023 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2023-2024-530)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-530 advisory. A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local attackers gaining root privileges. CVE-2022-27239 A flaw was found...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2024-524)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-524 advisory. libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time. CVE-2023-52426 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2024-038)

The version of containerd installed on the remote host is prior to 1.6.28-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2024-038 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-050)

The version of kernel installed on the remote host is prior to 5.10.209-198.858. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-050 advisory. 2024-12-05: CVE-2024-26687 was added to this advisory. A use-after-free vulnerability in the Linux...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2024-538)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-538 advisory. Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2024-522)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-522 advisory. A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local...

Amazon Linux 2023 : nerdctl (ALAS2023-2024-529)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-529 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can...

Amazon Linux 2023 : lynx (ALAS2023-2024-535)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-535 advisory. Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data. CVE-2021-38165 Tenable has extracte...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2024-518)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-518 advisory. 2024-02-29: CVE-2023-48706 was added to this advisory. Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very...

Important: nss-util

Issue Overview: Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8. CVE-2019-11729 A heap-based buffer overflow was...

Medium: unbound

Issue Overview: A vulnerability named 'Non-Responsive Delegation Attack' NRDelegation Attack has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by queryin...

Important: xorg-x11-server

Issue Overview: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 CVE-2023-6816 Reattaching to different master device...

Important: gstreamer1-plugins-bad-free

Issue Overview: GStreamer-SA-2024-0001: AV1 codec parser potential buffer overflow during tile list parsing NOTE: https://gstreamer.freedesktop.org/security/sa-2024-0001.html NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/mergerequests/5970 NOTE: Fixed by:...

Important: gstreamer1-plugins-bad-free

Issue Overview: GStreamer-SA-2024-0001: AV1 codec parser potential buffer overflow during tile list parsing NOTE: https://gstreamer.freedesktop.org/security/sa-2024-0001.html NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/mergerequests/5970 NOTE: Fixed by:...