Amazon Linux AMI : ca-certificates (ALAS-2023-1690)

The version of ca-certificates installed on the remote host is prior to 2018.2.22-65.1.29. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1690 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while...

Amazon Linux 2 : postgresql (ALAS-2023-1949)

The version of postgresql installed on the remote host is prior to 9.2.24-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1949 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

Amazon Linux AMI : openldap (ALAS-2023-1691)

The version of openldap installed on the remote host is prior to 2.4.40-16.32. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1691 advisory. In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backen...

Amazon Linux 2 : clamav (ALAS-2023-1964)

The version of clamav installed on the remote host is prior to 0.103.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1964 advisory. Possible remote code execution vulnerability in the ClamAV HFS+ file parser. The issue affects ClamAV versions 1.0.0 and...

Amazon Linux 2 : rust (ALAS-2023-1959)

The version of rust installed on the remote host is prior to 1.66.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1959 advisory. Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code ...

Amazon Linux 2 : git (ALAS-2023-1943)

The version of git installed on the remote host is prior to 2.23.1-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1943 advisory. A flaw was found in the git fast-import command where it provides the export-marks feature that may unexpectedly overwrite...

Amazon Linux AMI : squid (ALAS-2023-1687)

The version of squid installed on the remote host is prior to 3.5.20-17.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1687 advisory. An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of...

Amazon Linux 2 : nspr (ALAS-2023-1953)

The version of nspr installed on the remote host is prior to 4.32.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1953 advisory. NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

Amazon Linux 2 : libXpm (ALAS-2023-1962)

The version of libXpm installed on the remote host is prior to 3.5.12-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1962 advisory. A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be...

Amazon Linux 2 : protobuf (ALAS-2023-1948)

The version of protobuf installed on the remote host is prior to 2.5.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1948 advisory. A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads ...

Amazon Linux 2 : libgovirt (ALAS-2023-1939)

The version of libgovirt installed on the remote host is prior to 0.3.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1939 advisory. Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A...

Amazon Linux 2 : ImageMagick (ALAS-2023-1961)

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1961 advisory. ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image e.g., for resize, the convert...

Amazon Linux AMI : libXpm (ALAS-2023-1693)

The version of libXpm installed on the remote host is prior to 3.5.10-2.10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1693 advisory. A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will b...

Amazon Linux AMI : xorg-x11-server (ALAS-2023-1689)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1689 advisory. A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data,...

Amazon Linux 2 : spice-protocol (ALAS-2023-1940)

The version of spice-protocol installed on the remote host is prior to 0.12.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1940 advisory. Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A...

Amazon Linux 2 : thunderbird (ALAS-2023-1951)

The version of thunderbird installed on the remote host is prior to 102.7.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1951 advisory. 2025-01-30: CVE-2022-31744 was added to this advisory. 2025-01-30: CVE-2022-3155 was added to this advisory...

Amazon Linux 2 : thunderbird (ALAS-2023-1945)

The version of thunderbird installed on the remote host is prior to 68.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1945 advisory. The Mozilla Foundation Security Advisory describes this flaw as: Due to confusion about ValueTags on JavaScript...

Amazon Linux 2 : httpd (ALAS-2023-1938)

The version of httpd installed on the remote host is prior to 2.4.55-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1938 advisory. A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory...

Amazon Linux AMI : clamav (ALAS-2023-1694)

The version of clamav installed on the remote host is prior to 0.103.8-1.52. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1694 advisory. Possible remote code execution vulnerability in the ClamAV HFS+ file parser. The issue affects ClamAV versions 1.0.0 an...

Amazon Linux AMI : libconfuse (ALAS-2023-1692)

The version of libconfuse installed on the remote host is prior to 2.7-4.4. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1692 advisory. cfgtildeexpand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read. CVE-2022-40320 Tenable has extracted the precedi...