Amazon Linux 2 : xerces-c (ALAS-2023-2327)

The version of xerces-c installed on the remote host is prior to 3.1.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2327 advisory. An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request...

Amazon Linux 2 : cri-tools (ALAS-2023-2324)

The version of cri-tools installed on the remote host is prior to 1.26.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2324 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : nautilus (ALAS-2023-2331)

The version of nautilus installed on the remote host is prior to 3.26.3.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2331 advisory. GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive. CVE-2022-3729...

Amazon Linux 2 : opensc (ALAS-2023-2323)

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2323 advisory. Potential PIN bypass.When the token/card was plugged into the computer and authenticated from one process, it could be use...

Amazon Linux 2 : libxml2 (ALAS-2023-2321)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2321 advisory. libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNo...

Amazon Linux 2 : kernel (ALAS-2023-2328)

The version of kernel installed on the remote host is prior to 4.14.327-246.539. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2328 advisory. 2024-07-03: CVE-2023-52574 was added to this advisory. 2024-06-06: CVE-2023-52567 was added to this advisory...

Amazon Linux 2 : libguestfs-winsupport (ALAS-2023-2332)

The version of libguestfs-winsupport installed on the remote host is prior to 7.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2332 advisory. An invalid return code in fusekernmount enables intercepting of libfuse-lite protocol traffic between NTFS-3G...

Amazon Linux 2 : zlib (ALAS-2023-2320)

The version of zlib installed on the remote host is prior to 1.2.7-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2320 advisory. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long...

Amazon Linux 2 : vim (ALAS-2023-2319)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2319 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. CVE-2023-5441 Use After Free in GitHub repository vim/vim prior to v9.0.2010. CVE-2023-553...

Medium: nautilus

Issue Overview: GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive. CVE-2022-37290 Affected Packages: nautilus Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between A...

Medium: kernel

Issue Overview: A flaw in the kernel Xen event handler can cause a deadlock with Xen console handling in unprivileged Xen guests. CVE-2023-34324 A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer skb was assumed to be associated with a device before callin...

Important: cri-tools

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cri-tools Note: This advisory is applicable to Amazon...

Important: cni-plugins

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cni-plugins Note: This advisory is applicable to Amazo...

Important: golist

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: golist Note: This advisory is applicable to Amazon Lin...

Important: python

Issue Overview: An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. CVE-2022-48565 Affected Packages: python Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Amazon Linux 2 : docker (ALASECS-2023-019)

The version of docker installed on the remote host is prior to 20.10.25-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-019 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Templates did not properly consider backticks...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-042 (ALASKERNEL-5.10-2023-042)

The version of kernel installed on the remote host is prior to 5.10.198-187.748. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-042 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: unregister...

Medium: opensc

Issue Overview: Potential PIN bypass. When the token/card was plugged into the computer and authenticated from one process, it could be used to provide cryptographic operations from different process when the empty, zero-length PIN and the token can track the login status using some of its...

Important: xerces-c

Issue Overview: An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. CVE-2023-37536 Affected Packages: xerces-c Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Low: vim

Issue Overview: The severity level was changed from Medium to Low. NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. CVE-2023-5441 Use After Free in GitHub repository vim/vim prior to v9.0.2010. CVE-2023-5535 Affected Packages: vim Note: This...