Amazon Linux 2023 : docker (ALAS2023-2024-542)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-542 advisory. 2024-08-28: CVE-2023-45289 was added to this advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2024-555)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-555 advisory. The /boot/efi/EFI/fedora/grub.cfg configuration file allows an unprivileged user with physical access to a computer to bypass the GRUB password protection feature on many but not all UEFI-based systems...

Amazon Linux 2023 : libgit2, libgit2-devel (ALAS2023-2024-541)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-541 advisory. libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted...

Amazon Linux 2023 : perl-Cpanel-JSON-XS (ALAS2023-2024-556)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-556 advisory. The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service. CVE-2022-48623 Tenable has...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-553)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-553 advisory. Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses when there is a zone...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2024-006)

The version of postgresql installed on the remote host is prior to 13.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL13-2024-006 advisory. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute...

Amazon Linux 2 : libpq (ALASPOSTGRESQL12-2024-009)

The version of libpq installed on the remote host is prior to 12.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL12-2024-009 advisory. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary...

Amazon Linux 2023 : cpio (ALAS2023-2024-557)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-557 advisory. cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. CVE-2015-1197 Tenable has extracted the preceding...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-022)

The version of firefox installed on the remote host is prior to 115.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-022 advisory. When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resultin...

Amazon Linux 2023 : libuv, libuv-devel, libuv-static (ALAS2023-2024-540)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-540 advisory. libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows counterpart src/win/getaddrinfo.c, truncates hostnames to...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2024-006)

The version of postgresql installed on the remote host is prior to 14.11-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-006 advisory. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-549)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-549 advisory. dmtablecreate in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to in alloctargets allocate more than INTMAX bytes, and crash, because of a missing check for struct...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2024-546)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-546 advisory. A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set- bootflag will create a temporary file with the new grubenv content and rename it to the original...

Amazon Linux 2 : containerd (ALASECS-2024-035)

The version of containerd installed on the remote host is prior to 1.7.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-035 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset ma...

Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2024-548)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-548 advisory. A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding. This issue may...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2024-008)

The version of postgresql installed on the remote host is prior to 14.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-008 advisory. A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL...

Amazon Linux 2 : engrampa (ALASMATE-DESKTOP1.X-2024-008)

The version of engrampa installed on the remote host is prior to 1.24.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2MATE-DESKTOP1.X-2024-008 advisory. Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal...

Important: libpq

Issue Overview: Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted...

Important: engrampa

Issue Overview: Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution RCE on the target. While handling CPIO archives, the Engrampa Archive manager follows symlin...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2024-005)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2OPENSSL-SNAPSAFE-2024-005 advisory. Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of...