Important: redis

Issue Overview: Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis BIT command are vulnerable to integ...

Amazon Linux AMI : libssh2 (ALAS-2023-1834)

The version of libssh2 installed on the remote host is prior to 1.4.2-3.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1834 advisory. An issue was discovered in function libssh2packetadd in libssh2 1.10.0 allows attackers to access out of bounds memory...

Medium: ruby

Issue Overview: A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service ReDoS during the parsing of dates. This flaw allows an attacker to hang a ruby application by providing a specially crafted date string. The highest threat to this...

Amazon Linux AMI : busybox (ALAS-2023-1832)

The version of busybox installed on the remote host is prior to 1.34.1-1.16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1832 advisory. There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this...

Medium: yasm

Issue Overview: Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial of service via a crafted file. CVE-2023-37732 Affected Packages: yasm Note: This advisory is applicable to Amazon Linux 2 - Graphicsmagick1.3...

Amazon Linux AMI : kernel (ALAS-2023-1827)

The version of kernel installed on the remote host is prior to 4.14.322-170.535. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1827 advisory. A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nftablesapi.c...

Amazon Linux AMI : ImageMagick (ALAS-2023-1831)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1831 advisory. A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the...

Amazon Linux AMI : cups (ALAS-2023-1828)

The version of cups installed on the remote host is prior to 1.4.2-67.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1828 advisory. An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey...

Amazon Linux AMI : hwloc (ALAS-2023-1833)

The version of hwloc installed on the remote host is prior to 1.7-3.8. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1833 advisory. An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via...

Amazon Linux AMI : libtiff (ALAS-2023-1830)

The version of libtiff installed on the remote host is prior to 4.0.3-35.45. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1830 advisory. LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a...

Amazon Linux AMI : vim (ALAS-2023-1826)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1826 advisory. vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service DoS via the exbufferall method. CVE-2021-3236 Integer Overflow or Wraparound in GitHub...

Amazon Linux AMI : ghostscript (ALAS-2023-1835)

The version of ghostscript installed on the remote host is prior to 8.70-24.30. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1835 advisory. Buffer Overflow vulnerability in cljmediasize function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attacke...

Important: nginx

Issue Overview: A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote...

Amazon Linux AMI : libtiff (ALAS-2023-1829)

The version of libtiff installed on the remote host is prior to 4.0.3-35.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1829 advisory. LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a...

Important: tomcat

Issue Overview: A memory leak flaw was found in Apache Tomcat, where an HTTP upgrade connection does not release for WebSocket connections once the WebSocket connection is closed. If a sufficient number of such requests are made, an OutOfMemoryError occurs, leading to a denial of service. The...

Medium: nginx

Issue Overview: NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. CVE-2019-20372 Affected Packages: nginx Note: Th...

Low: redis

Issue Overview: A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an attacker with access to Redis to inject Lua code that executes the potentially higher privileges of another Redis user. CVE-2022-24735 A flaw was found in the Red...

Medium: tomcat

Issue Overview: A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to...

Medium: python38

Issue Overview: The CryptProtectMemory function in cng.sys aka the Cryptography Next Generation driver in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, an...

Medium: gsl

Issue Overview: A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing a maliciously crafted input data for gslstatsquantilefromsorteddata of the library may lead to unexpected application...