Amazon Linux 2 : qt5-qtbase (ALAS-2023-2159)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2159 advisory. In QT, there is an integer overflow in qfixedp.h when rendering SVG image on the minimal plugin. CVE-2023-32763 Tenable has...

Amazon Linux 2 : libvncserver (ALAS-2023-2170)

The version of libvncserver installed on the remote host is prior to 0.9.9-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2170 advisory. libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup. CVE-2020-29260 Tenable has...

Amazon Linux 2 : gstreamer1-plugins-good (ALAS-2023-2155)

The version of gstreamer1-plugins-good installed on the remote host is prior to 1.18.4-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2155 advisory. Integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the...

Amazon Linux 2 : golang (ALAS-2023-2163)

The version of golang installed on the remote host is prior to 1.20.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2163 advisory. RESERVEDNOTE: https://groups.google.com/g/golang-announce/c/V0aBFqaFsE CVE-2022-41724 Golang: net/http, mime/multipart:...

Amazon Linux 2 : python-ipaddress (ALAS-2023-2174)

The version of python-ipaddress installed on the remote host is prior to 1.0.16-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2174 advisory. A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and...

Amazon Linux 2 : avahi (ALAS-2023-2161)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2161 advisory. avahi-daemon denial of service can be caused by unprivileged users via DBus CVE-2023-1981 Tenable has extracted the preceding...

Amazon Linux AMI : bind (ALAS-2023-1789)

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.90. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1789 advisory. A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished...

Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2023-2154)

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2154 advisory. Integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the...

Amazon Linux 2 : thunderbird (ALAS-2023-2156)

The version of thunderbird installed on the remote host is prior to 102.13.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2156 advisory. An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This...

Amazon Linux 2 : libicu60 (ALAS-2023-2172)

The version of libicu60 installed on the remote host is prior to 60.3-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2172 advisory. International Components for Unicode ICU-20850 v66.1 was discovered to contain a use after free bug in the pkgcreateWithAssemblyCod...

Amazon Linux 2 : icu (ALAS-2023-2171)

The version of icu installed on the remote host is prior to 50.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2171 advisory. International Components for Unicode ICU-20850 v66.1 was discovered to contain a use after free bug in the pkgcreateWithAssemblyCode...

Amazon Linux 2 : bluez (ALAS-2023-2167)

The version of bluez installed on the remote host is prior to 5.44-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2167 advisory. A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially...

Medium: python-mako

Issue Overview: Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. CVE-2022-40023 Affected Packages: python-mako Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Medium: libtiff

Issue Overview: Memory leak in memory leak in tiffcrop.c. CVE-2023-3576 Affected Packages: libtiff Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update libtif...

Medium: SDL2

Issue Overview: A memory leak issue was discovered in SDL2 version = SDL2-2.0.8. CVE-2022-4743 Affected Packages: SDL2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: R...

Medium: compat-libtiff3

Issue Overview: Memory leak in memory leak in tiffcrop.c. CVE-2023-3576 Affected Packages: compat-libtiff3 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum updat...

Important: apache-ivy

Issue Overview: When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which ar...

Medium: scipy

Issue Overview: A use-after-free issue was discovered in PyFindObjects function in SciPy versions prior to 1.8.0. CVE-2023-29824 Affected Packages: scipy Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...

Medium: samba

Issue Overview: A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file or printer instead of client-supplied data. The client cannot control th...

Low: libvncserver

Issue Overview: libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup. CVE-2020-29260 Affected Packages: libvncserver Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL...