Important: python-reportlab

Issue Overview: paraparser in ReportLab before 3.5.31 allows remote code execution because startunichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with 'unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626...

Important: java-1.8.0-openjdk

Issue Overview: An issue was discovered in function ciMethodBlocks::makeblockat in Oracle JDK HotSpot VM 11, 17 and OpenJDK HotSpot VM 8, 11, 17, allows attackers to cause a denial of service. CVE-2022-40433 Affected Packages: java-1.8.0-openjdk Note: This advisory is applicable to Amazon Linux 2...

Medium: nasm

Issue Overview: A Use After Free vulnerability in function newToken in asm/preproc.c in nasm 2.14.02 allows attackers to cause a denial of service via crafted nasm command. CVE-2020-18780 A Segmentation Fault issue discovered in in ieeesegment function in outieee.c in nasm 2.14.03 and 2.15 allows...

Amazon Linux 2 : expat (ALAS-2023-2280)

The version of expat installed on the remote host is prior to 2.1.0-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2280 advisory. Expat aka libexpat before 2.4.4 has an integer overflow in the doProlog function. CVE-2022-23990 A flaw was found in expat....

Amazon Linux 2 : kernel, --advisory ALAS2-2023-2264 (ALAS-2023-2264)

The version of kernel installed on the remote host is prior to 4.14.326-245.539. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2264 advisory. A flaw was found in the Linux kernel's IP framework for transforming packets XFRM subsystem. This issue may allow ...

Amazon Linux 2 : freerdp (ALAS-2023-2269)

The version of freerdp installed on the remote host is prior to 2.11.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2269 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. This issue affect...

Amazon Linux 2 : libtiff (ALAS-2023-2274)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2274 advisory. libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size afte...

Medium: libtiff

Issue Overview: libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage in tiffcrop cause heap-buffer-overflow and SEGV. CVE-2023-25433 A vulnerability was found in libtiff library. This security flaw causes a heap...

Important: curl

Issue Overview: HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1 NOTE: https://curl.se/docs/CVE-2023-38039.html NOTE: Introduced by: https://github.com/curl/curl/commit/7c8c723682d524ac9580b9ca3b71419163cb5660 curl-7830 NOTE: Experimental tag removed in:...

Amazon Linux 2 : python-pillow (ALAS-2023-2286)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2286 advisory. The 1 loaddjpeg function in JpegImagePlugin.py, 2 Ghostscript function in EpsImagePlugin.py, 3 load...

Medium: exiv2

Issue Overview: Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file. CVE-2020-18831 Affected Packages: exiv2 Note: This advisory is applicable to Amazon...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2023-2278)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.382.b05-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2278 advisory. An issue was discovered in function ciMethodBlocks::makeblockat in Oracle JDK HotSpot VM 11, 17 and OpenJDK...

Amazon Linux 2 : python-reportlab (ALAS-2023-2285)

The version of python-reportlab installed on the remote host is prior to 2.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2285 advisory. paraparser in ReportLab before 3.5.31 allows remote code execution because startunichar in paraparser.py evaluates untruste...

Amazon Linux 2 : ImageMagick (ALAS-2023-2272)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2272 advisory. A vulnerability was found in ImageMagick. This issue occurs as an undefined behavior, casting double to sizet in svg, mvg a...

Amazon Linux 2 : libarchive (ALAS-2023-2279)

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2279 advisory. In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer...

Amazon Linux 2 : curl (ALAS-2023-2271)

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2271 advisory. HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1NOTE:...

Amazon Linux 2 : mutt (ALAS-2023-2265)

The version of mutt installed on the remote host is prior to 1.5.21-29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2265 advisory. Null pointer dereference when viewing a specially crafted email in Mutt 1.5.2 1.5.2 2.2.12 CVE-2023-4875 Tenable has...

Amazon Linux 2 : exiv2 (ALAS-2023-2284)

The version of exiv2 installed on the remote host is prior to 0.27.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2284 advisory. Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of...

Amazon Linux 2 : kernel, --advisory ALAS2-2023-2268 (ALAS-2023-2268)

The version of kernel installed on the remote host is prior to 4.14.322-244.536. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2268 advisory. A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code can try to...

Amazon Linux 2 : wireshark (ALAS-2023-2276)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2276 advisory. LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or craft...