Important: less

Issue Overview: In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal. CVE-2022-46663 closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE. CVE-2022-48624 Affected Packages: less Issue Correction: Run dn...

Important: golang

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: golang Issue Correction: Run dnf update golang --releasever 2023.0.20230322 or dnf update --advisory ALAS2023-2023-142 --releasever 2023.0.20230322 to update your system. More information o...

Medium: giflib

Issue Overview: An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read. CVE-2020-23922 There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB in gif2rgb.c:298:45. CVE-2022-28506 Affected Packages: giflib Issue Correction: Ru...

Low: autotrace

Issue Overview: AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660. CVE-2022-32323 Affected Packages: autotrace Issue Correction: Run dnf update autotrace --releasever 2023.0.20230322 or dnf update --advisory ALAS2023-2023-144 --releasever...

Amazon Linux 2 : libxml2 (ALAS-2023-1996)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1996 advisory. An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser...

Amazon Linux 2 : ghostscript (ALAS-2023-2003)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2003 advisory. Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-383...

Amazon Linux AMI : tar (ALAS-2023-1704)

The version of tar installed on the remote host is prior to 1.26-31.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1704 advisory. GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitati...

Amazon Linux 2 : tar (ALAS-2023-1994)

The version of tar installed on the remote host is prior to 1.26-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1994 advisory. GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation...

Amazon Linux AMI : lighttpd (ALAS-2023-1705)

The version of lighttpd installed on the remote host is prior to 1.4.53-1.37. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1705 advisory. In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request websocket handshake i...

Amazon Linux 2 : xdg-utils (ALAS-2023-2002)

The version of xdg-utils installed on the remote host is prior to 1.1.0-0.17.20120809git. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2002 advisory. A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs,...

Amazon Linux 2 : libsndfile (ALAS-2023-1998)

The version of libsndfile installed on the remote host is prior to 1.0.25-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1998 advisory. An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially...

Amazon Linux 2 : aws-nitro-enclaves-cli (ALASNITRO-ENCLAVES-2023-021)

The version of aws-nitro-enclaves-cli installed on the remote host is prior to 1.2.2-0. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-021 advisory. Hyperium Hyper before 0.14.19 does not allow for customization of the maxheaderlistsize method in the H...

Amazon Linux AMI : kernel (ALAS-2023-1707)

The version of kernel installed on the remote host is prior to 4.14.301-153.528. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1707 advisory. 2024-06-07: CVE-2023-26607 was added to this advisory. A vulnerability was found in Linux Kernel. It has been...

Amazon Linux 2 : vim (ALAS-2023-1991)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1991 advisory. Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. CVE-2023-1127 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has...

Amazon Linux AMI : xorg-x11-server (ALAS-2023-1702)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1702 advisory. A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo and ProcXkbGetDeviceInfo to read and write into freed...

Amazon Linux 2 : thunderbird (ALAS-2023-1988)

The version of thunderbird installed on the remote host is prior to 102.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1988 advisory. The Mozilla Foundation describes this issue as follows: Sometimes, when invalidating JIT code while following an...

Amazon Linux 2 : httpd (ALAS-2023-1989)

The version of httpd installed on the remote host is prior to 2.4.56-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1989 advisory. Some modproxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack...

Amazon Linux AMI : vim (ALAS-2023-1703)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1703 advisory. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. CVE-2023-0288 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. CVE-2023-0433 Divide By Zero in...

Amazon Linux AMI : kernel (ALAS-2023-1701)

The version of kernel installed on the remote host is prior to 4.14.309-159.529. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1701 advisory. Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as well as...

Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2023-2000)

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.10.4-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2000 advisory. A flaw was found in gstreamer-plugins-base where an out-of-bounds read when handling certain ID3v2 tags is possibl...