Amazon Linux 2 : shadow-utils (ALAS-2023-2247)

The version of shadow-utils installed on the remote host is prior to 4.1.5.1-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2247 advisory. A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fai...

Amazon Linux 2 : libssh2 (ALAS-2023-2257)

The version of libssh2 installed on the remote host is prior to 1.4.3-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2257 advisory. An issue was discovered in function libssh2packetadd in libssh2 1.10.0 allows attackers to access out of bounds memory...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2023-346)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-346 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now...

Amazon Linux 2 : opensc (ALAS-2023-2262)

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2262 advisory. OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decodebitstring in libopensc/asn1.c...

Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-350)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-350 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the- middle MITM network positioning between vCenter server and the virtual machine may be able to bypass...

Amazon Linux 2 : thunderbird (ALAS-2023-2248)

The version of thunderbird installed on the remote host is prior to 102.15.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2248 advisory. Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be...

Amazon Linux 2023 : gsl, gsl-devel (ALAS2023-2023-353)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-353 advisory. A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing a maliciously crafted input data for...

Amazon Linux 2 : ImageMagick (ALAS-2023-2251)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2251 advisory. A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the identif...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-348)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-348 advisory. Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of servi...

Amazon Linux 2 : ghostscript (ALAS-2023-2258)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2258 advisory. Buffer Overflow vulnerability in cljmediasize function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers ...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-351)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-351 advisory. An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. CVE-2022-40090 Tenable has extracted the preceding...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-349)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-349 advisory. KVM: arm64: Prevent unconditional donation of unmapped regions from the hostNOTE: https://source.android.com/docs/security/bulletin/2023-08-01NOTE:...

Amazon Linux 2 : elfutils (ALAS-2023-2259)

"The version of elfutils installed on the remote host is prior to 0.176-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2259 advisory. The libcpu component which is used by libasm of elfutils version 0.177 git 47780c9e, suffers from denial-of-service vulnerability...

Amazon Linux 2 : qt5-qtbase (ALAS-2023-2252)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2252 advisory. Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory...

Amazon Linux 2 : libjpeg-turbo (ALAS-2023-2254)

The version of libjpeg-turbo installed on the remote host is prior to 2.0.90-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2254 advisory. 2023-10-30: CVE-2020-17541 was added to this advisory. Libjpeg-turbo all version have a stack-based buffer overflow...

Amazon Linux 2023 : docker (ALAS2023-2023-345)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-345 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-344)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-344 advisory. Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains...

Medium: php

Issue Overview: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly quoted string. With the implementation of sqlite3snprintf, it is possible to force the function to return a single apostrophe if the function is called...

Medium: php

Issue Overview: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly quoted string. With the implementation of sqlite3snprintf, it is possible to force the function to return a single apostrophe if the function is called...

Important: php

Issue Overview: GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP NOTE: Fixed in 8.2.7, 8.1.20, 8.0.29 NOTE: https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw NOTE:...