Important: kernel-livepatch-5.10.179-166.674

Issue Overview: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are...

Important: kernel-livepatch-5.10.178-162.673

Issue Overview: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are...

Medium: glib2

Issue Overview: A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition. CVE-2021-3800 Affected Packages: glib2 Note: This advisory is applicable to Amazon Linux 2 AL2...

Important: thunderbird

Issue Overview: In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. CVE-2023-32205 The Mozilla Foundation Security Advisory describes this flaw as: An out-of-bound read could have led to...

Important: kernel-livepatch-5.10.176-157.645

Issue Overview: A use-after-free vulnerability was found in nfs42sscopen in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial of service. CVE-2022-4379 In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch...

Important: kernel

Issue Overview: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are...

Medium: apache-commons-io

Issue Overview: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus...

Amazon Linux 2022 : golang, golang-bin, golang-misc (ALAS2022-2022-128)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-128 advisory. A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating chunked encoding. This issue could allow request smuggling, but only if combined with an...

Amazon Linux AMI : libwebp (ALAS-2023-1748)

The version of libwebp installed on the remote host is prior to 0.3.0-10.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1748 advisory. A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes. CVE-2018-25013 Tenable has extracted th...

Amazon Linux AMI : tigervnc (ALAS-2023-1746)

The version of tigervnc installed on the remote host is prior to 1.8.0-21.35. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1746 advisory. A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited...

Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2023-180)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-180 advisory. Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply...

Amazon Linux AMI : glib2 (ALAS-2023-1749)

The version of glib2 installed on the remote host is prior to 2.36.3-5.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1749 advisory. GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in gmarkupparsecontextparse in gmarkup.c, related to utf8str...

Amazon Linux AMI : samba (ALAS-2023-1747)

The version of samba installed on the remote host is prior to 4.10.16-24.66. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1747 advisory. Netlogon RPC Elevation of Privilege Vulnerability. CVE-2022-38023 Tenable has extracted the preceding description block directly...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-181)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-181 advisory. A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able ...

Amazon Linux AMI : ImageMagick (ALAS-2023-1745)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1745 advisory. A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-179)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-179 advisory. qfqchangeclass in net/sched/schqfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQMINLMAX. CVE-2023-31436 Tenable has extracted the preceding description...

Amazon Linux AMI : kernel (ALAS-2023-1744)

The version of kernel installed on the remote host is prior to 4.14.314-164.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1744 advisory. A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inod...

Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2023-178)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-178 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Tenable has...

Amazon Linux 2 : wireshark (ALAS-2023-2040)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2040 advisory. TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection ...

Amazon Linux 2 : perl (ALAS-2023-2034)

The version of perl installed on the remote host is prior to 5.16.3-299. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2034 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where...