Amazon Linux 2023 : haproxy (ALAS2023-2024-496)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-496 advisory. HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule,...

Amazon Linux 2 : wireshark (ALAS-2024-2416)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2416 advisory. GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or...

Amazon Linux 2 : dbus (ALAS-2024-2428)

The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2428 advisory. D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon...

Amazon Linux 2 : thunderbird (ALAS-2024-2417)

The version of thunderbird installed on the remote host is prior to 115.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2417 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function...

Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2024-2427 (ALAS-2024-2427)

The version of webkitgtk4 installed on the remote host is prior to 2.42.3-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2427 advisory. Impact: Visiting a website that frames malicious content may lead to UI spoofing. Description: The issue was addressed...

Amazon Linux 2 : postfix (ALAS-2024-2420)

The version of postfix installed on the remote host is prior to 2.10.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2420 advisory. Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and...

Amazon Linux 2023 : perl-Spreadsheet-ParseExcel (ALAS2023-2024-491)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-491 advisory. Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution ACE vulnerability due to passing unvalidated inpu...

Amazon Linux 2023 : postfix, postfix-cdb, postfix-ldap (ALAS2023-2024-495)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-495 advisory. Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and smtpddiscardehlokeywords=chunking or certain other options that exist in recent...

Amazon Linux 2 : ghostscript (ALAS-2024-2422)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2422 advisory. An issue was discovered in the function gdevprnopenprinterseekable in Artifex Ghostscript through 10.02.0 allows remote attacker...

Amazon Linux AMI : apache-ivy (ALAS-2024-1910)

The version of apache-ivy installed on the remote host is prior to 2.2.0-5.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1910 advisory. When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied pattern...

Amazon Linux 2 : nss-softokn (ALAS-2024-2419)

The version of nss-softokn installed on the remote host is prior to 3.90.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2419 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2024-492)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-492 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a...

Amazon Linux AMI : nss-softokn (ALAS-2024-1907)

The version of nss-softokn installed on the remote host is prior to 3.53.1-6.49. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1907 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of t...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2024-497)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-497 advisory. Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2024-487)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-487 advisory. GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file CVE-2024-0208 IEEE 1609.2 dissector crash in...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2024-500)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-500 advisory. 2025-01-16: CVE-2024-11168 was added to this advisory. An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-498)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-498 advisory. 2024-02-29: CVE-2023-47108 was added to this advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as...

Important: firefox

Issue Overview: A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is...

Important: kernel

Issue Overview: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. CVE-2023-6606 A use-after-free flaw was found in the netfilter subsystem of...

Amazon Linux 2 : c-ares (ALAS-2024-2429)

The version of c-ares installed on the remote host is prior to 1.10.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2429 advisory. When cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will not be set, as seen when cross compiling...