Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-137)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-137 advisory. Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. CVE-2023-1127 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus ha...

Amazon Linux 2023 : device-mapper-multipath, device-mapper-multipath-devel, device-mapper-multipath-libs (ALAS2023-2023-141)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-141 advisory. multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can...

Amazon Linux 2023 : docker (ALAS2023-2023-143)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-143 advisory. A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the supplementary group access setup. CVE-2022-36109 Tenable has extracted the preceding...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2023-136)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-136 advisory. Some modproxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-138)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-138 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: Fix potential null-ptr-deref due to drmmmodeconfiginit CVE-2022-50556 A double-free vulnerability was found in the...

Important: python-certifi

Issue Overview: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from...

Amazon Linux AMI : dnsmasq (ALAS-2020-1458)

The version of dnsmasq installed on the remote host is prior to 2.76-16.16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1458 advisory. A flaw was found in the Dnsmasq application where a remote attacker can trigger a memory leak by sending specially crafted DHCP...

Amazon Linux 2 : xdg-utils (ALAS-2023-2002)

The version of xdg-utils installed on the remote host is prior to 1.1.0-0.17.20120809git. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2002 advisory. A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs,...

Amazon Linux 2 : vim (ALAS-2023-1991)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1991 advisory. Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. CVE-2023-1127 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has...

Amazon Linux AMI : kernel (ALAS-2023-1707)

The version of kernel installed on the remote host is prior to 4.14.301-153.528. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1707 advisory. 2024-06-07: CVE-2023-26607 was added to this advisory. A vulnerability was found in Linux Kernel. It has been...

Amazon Linux AMI : xorg-x11-server (ALAS-2023-1702)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1702 advisory. A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo and ProcXkbGetDeviceInfo to read and write into freed...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-027)

The version of kernel installed on the remote host is prior to 5.10.167-147.601. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-027 advisory. 2024-02-01: CVE-2023-1073 was added to this advisory. A flaw was found in the Linux kernel's Layer 2...

Amazon Linux AMI : kernel (ALAS-2023-1701)

The version of kernel installed on the remote host is prior to 4.14.309-159.529. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1701 advisory. Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as well as...

Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2023-2000)

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.10.4-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2000 advisory. A flaw was found in gstreamer-plugins-base where an out-of-bounds read when handling certain ID3v2 tags is possibl...

Amazon Linux 2 : sssd (ALAS-2023-1995)

The version of sssd installed on the remote host is prior to 1.16.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1995 advisory. A vulnerability was found in SSSD, in the libssscertmap functionality. PKINIT enables a client to authenticate to the KDC using an...

Amazon Linux AMI : lighttpd (ALAS-2023-1705)

The version of lighttpd installed on the remote host is prior to 1.4.53-1.37. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1705 advisory. In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request websocket handshake i...

Amazon Linux 2 : aws-nitro-enclaves-cli (ALASNITRO-ENCLAVES-2023-021)

The version of aws-nitro-enclaves-cli installed on the remote host is prior to 1.2.2-0. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-021 advisory. Hyperium Hyper before 0.14.19 does not allow for customization of the maxheaderlistsize method in the H...

Amazon Linux 2 : audiofile (ALAS-2023-1997)

The version of audiofile installed on the remote host is prior to 0.3.6-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1997 advisory. In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows ...

Medium: sudo

Issue Overview: Sudo before 1.9.13 does not escape control characters in log messages. CVE-2023-28486 Sudo before 1.9.13 does not escape control characters in sudoreplay output. CVE-2023-28487 Affected Packages: sudo Issue Correction: Run dnf update sudo --releasever 2023.0.20230322 or dnf update...

Low: vim

Issue Overview: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. CVE-2023-1127 Affected Packages: vim Issue Correction: Run dnf update vim --releasever 2023.0.20230322 or dnf update --advisory ALAS2023-2023-137 --releasever 2023.0.20230322 to update your system. More information on...