Amazon Linux 2 : poppler (ALAS-2023-2243)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2243 advisory. Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service...

Amazon Linux 2 : kernel (ALAS-2023-2232)

The version of kernel installed on the remote host is prior to 4.14.322-244.539. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2232 advisory. A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentialit...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2023-317)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-317 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client...

Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2023-321)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-321 advisory. lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2023-324)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-324 advisory. In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2023-339)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-339 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : file, file-devel, file-libs (ALAS2023-2023-333)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-333 advisory. File before 5.43 has an stack-based buffer over-read in filecopystr in funcs.c. NOTE: File is the name of an Open Source project. CVE-2022-48554 Tenable has extracted the preceding description block...

Amazon Linux 2023 : hwloc, hwloc-devel, hwloc-gui (ALAS2023-2023-335)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-335 advisory. An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. CVE-2022-47022 Tenable has extracted the...

Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2023-325)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-325 advisory. In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities...

Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-320)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-320 advisory. ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw. CVE-2023-39978 Tenable has extracted the preceding description block directly from the test...

Amazon Linux 2 : krb5 (ALAS-2023-2225)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2225 advisory. lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because...

Amazon Linux 2 : qt5-qtsvg (ALAS-2023-2242)

The version of qt5-qtsvg installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2242 advisory. 2023-09-27: CVE-2021-3481 was added to this advisory. Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg...

Amazon Linux 2 : ImageMagick (ALAS-2023-2239)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2239 advisory. An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c...

Amazon Linux 2023 : dmidecode (ALAS2023-2023-328)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-328 advisory. Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. CVE-2023-30630 Tenable has extracted the...

Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2023-2238 (ALAS-2023-2238)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1377.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2238 advisory. A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fa...

Amazon Linux 2023 : gdk-pixbuf2, gdk-pixbuf2-devel, gdk-pixbuf2-modules (ALAS2023-2023-341)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-341 advisory. GNOME GdkPixbuf aka GDK-PixBuf before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c compositeframe. This overflow is...

Amazon Linux 2 : rust (ALAS-2023-2223)

The version of rust installed on the remote host is prior to 1.68.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2223 advisory. Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2023-323)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-323 advisory. Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archiv...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-326)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-326 advisory. .NET and Visual Studio Remote Code Execution Vulnerability CVE-2023-35390 .NET Core and Visual Studio Denial of Service Vulnerability CVE-2023-38178 .NET and Visual Studio Denial of Service...

Amazon Linux 2 : LibRaw (ALAS-2023-2234)

The version of LibRaw installed on the remote host is prior to 0.19.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2234 advisory. In LibRaw, an out-of-bounds read vulnerability exists within the LibRaw::adobecopypixel function libraw\src\decoders\dng.c...