Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2023-2038)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.372.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2038 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-045)

The version of kernel installed on the remote host is prior to 5.4.242-155.348. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-045 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : jdom (ALAS-2023-2045)

The version of jdom installed on the remote host is prior to 1.1.3-6.1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2045 advisory. An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request...

Amazon Linux 2 : libksba (ALAS-2023-2041)

The version of libksba installed on the remote host is prior to 1.3.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2041 advisory. Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE-2022-47629 Tenable has extracte...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-018)

The version of kernel installed on the remote host is prior to 5.15.110-70.141. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-018 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : qt5-qtbase (ALAS-2023-2036)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2036 advisory. When using the Qt SQL ODBC driver plugin, then it is possible to trigger a DOS with a specifically crafted string RESERVEDNOTE:...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-032)

The version of kernel installed on the remote host is prior to 5.10.179-166.674. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-032 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : kernel (ALAS-2023-2035)

The version of kernel installed on the remote host is prior to 4.14.314-237.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2035 advisory. A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra ino...

Amazon Linux 2 : samba (ALAS-2023-2042)

The version of samba installed on the remote host is prior to 4.10.16-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2042 advisory. Netlogon RPC Elevation of Privilege Vulnerability. CVE-2022-38023 Tenable has extracted the preceding description block directly...

Amazon Linux 2 : openssl11 (ALAS-2023-2039)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2039 advisory. A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509...

Amazon Linux 2 : libssh2 (ALAS-2023-2046)

The version of libssh2 installed on the remote host is prior to 1.4.3-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2046 advisory. An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the libssh2packetrequire and libssh2packetrequirev...

Amazon Linux 2 : golang (ALAS-2023-2037)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2037 advisory. HTTP and MIME header parsing could allocate large amounts of memory, even when parsing small inputs. Certain unusual patterns of...

Amazon Linux 2 : inkscape (ALAS-2023-2043)

The version of inkscape installed on the remote host is prior to 0.92.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2043 advisory. Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized...

Amazon Linux 2 : tomcat (ALAS-2023-2047)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2047 advisory. A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A local attacker...

Amazon Linux 2 : glib2 (ALAS-2023-2049)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2049 advisory. In GNOME GLib 2.56.1, gmarkupparsecontextendparse in gmarkup.c has a NULL pointer dereference. CVE-2018-16428 GNOME GLib...

Amazon Linux 2 : libwebp (ALAS-2023-2048)

The version of libwebp installed on the remote host is prior to 0.3.0-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2048 advisory. 2023-08-03: CVE-2018-25014 was added to this advisory. A heap-based buffer overflow was found in libwebp in versions befo...

Amazon Linux 2 : gd (ALAS-2023-2044)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2044 advisory. DISPUTED gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is...

Medium: inkscape

Issue Overview: Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized information. CVE-2021-42700 Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information...

Medium: jdom

Issue Overview: An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. CVE-2021-33813 Affected Packages: jdom Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Important: wireshark

Issue Overview: TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0412 Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet...