Amazon Linux 2 : grilo (ALAS-2023-2306)

The version of grilo installed on the remote host is prior to 0.3.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2306 advisory. In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates,...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2023-030)

The version of docker installed on the remote host is prior to 20.10.25-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-030 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Templates did not properly conside...

Amazon Linux 2 : vim (ALAS-2023-2288)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2288 advisory. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969. CVE-2023-5344 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that...

Amazon Linux 2 : containerd (ALASECS-2023-014)

The version of containerd installed on the remote host is prior to 1.4.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-014 advisory. A flaw was found in containerd CRI plugin. Containers launched through containerd CRI implementation that share the same image...

Amazon Linux 2 : docker (ALASECS-2023-015)

The version of docker installed on the remote host is prior to 20.10.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-015 advisory. A flaw was found in the userns-remap feature of Docker. The root user in the remapped namespace can modify files under...

Amazon Linux 2 : grub2 (ALAS-2023-2292)

The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2292 advisory. An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a...

Amazon Linux 2 : thunderbird (ALAS-2023-2294)

The version of thunderbird installed on the remote host is prior to 102.15.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2294 advisory. VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. CVE-2023-44488 Tenable has extracted...

Amazon Linux 2 : docker (ALASECS-2023-013)

The version of docker installed on the remote host is prior to 20.10.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-013 advisory. A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the...

Amazon Linux 2 : ImageMagick (ALAS-2023-2289)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2289 advisory. A vulnerability was found in ImageMagick where heap use-after-free was found in coders/bmp.c. CVE-2023-5341 Tenable has...

Amazon Linux 2 : libtiff (ALAS-2023-2300)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2300 advisory. There exists one heap buffer overflow in TIFFmemcpy in tifunix.c in libtiff 4.0.10, which allows an attacker to cause a...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2023-2303)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1705.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2303 advisory. 2023-10-30: CVE-2023-29409 was added to this advisory. 2023-10-30: CVE-2023-3978 was added to this advisory...

Amazon Linux 2 : libwebp12 (ALAS-2023-2290)

The version of libwebp12 installed on the remote host is prior to 1.2.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2290 advisory. Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memor...

Amazon Linux 2 : ghostscript (ALAS-2023-2308)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2308 advisory. A buffer overflow vulnerability in epscprintpage in devices/gdevepsc.c of Artifex Software GhostScript v9.50 allows a...

Amazon Linux 2 : sudo (ALAS-2023-2301)

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2301 advisory. Sudo before 1.9.13 does not escape control characters in log messages. CVE-2023-28486 Sudo before 1.9.13 does not escape...

Amazon Linux 2 : libX11 (ALAS-2023-2296)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2296 advisory. libX11: out-of-bounds memory access in XkbReadKeySyms CVE-2023-43785 libX11: integer overflow in XCreateImage leading to a...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2023-008)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0392.b08-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2023-008 advisory. Vulnerability in Oracle Java SE component: CORBA. Supported versions that are affected a...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2023-2314)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.9+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2314 advisory. Memory corruption bug on JDK 21 and 20 when AVX-512 is enabled. CVE-2023-22025 Vulnerability in the...

Amazon Linux 2 : ceph-common (ALAS-2023-2297)

The version of ceph-common installed on the remote host is prior to 10.2.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2297 advisory. A flaw was found in rgw. This flaw allows an unprivileged user to write to any buckets accessible by a given key if a POST's...

Amazon Linux 2 : libXpm (ALAS-2023-2295)

The version of libXpm installed on the remote host is prior to 3.5.12-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2295 advisory. libX11: integer overflow in XCreateImage leading to a heap overflow. CVE-2023-43787 libXpm: out of bounds read in...

Amazon Linux 2 : oniguruma (ALAS-2023-2311)

The version of oniguruma installed on the remote host is prior to 5.9.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2311 advisory. An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through...