Amazon Linux 2023 : postfix, postfix-cdb, postfix-ldap (ALAS2023-2024-495)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-495 advisory. Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and smtpddiscardehlokeywords=chunking or certain other options that exist in recent...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2024-497)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-497 advisory. Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by...

Amazon Linux AMI : nss-softokn (ALAS-2024-1907)

The version of nss-softokn installed on the remote host is prior to 3.53.1-6.49. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1907 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of t...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2024-487)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-487 advisory. GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file CVE-2024-0208 IEEE 1609.2 dissector crash in...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2024-492)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-492 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-498)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-498 advisory. 2024-02-29: CVE-2023-47108 was added to this advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as...

Amazon Linux 2 : nss-softokn (ALAS-2024-2419)

The version of nss-softokn installed on the remote host is prior to 3.90.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2419 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the...

Amazon Linux AMI : perl-Spreadsheet-ParseExcel (ALAS-2024-1905)

The version of perl-Spreadsheet-ParseExcel installed on the remote host is prior to 0.5900-5.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1905 advisory. Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel i...

Important: kernel

Issue Overview: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. CVE-2023-6606 Affected Packages: kernel Note: This advisory is applicable t...

Important: kernel

Issue Overview: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. CVE-2023-6606 A use-after-free flaw was found in the netfilter subsystem of...

Amazon Linux 2 : kernel (ALAS-2024-2418)

The version of kernel installed on the remote host is prior to 4.14.336-253.554. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2418 advisory. An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue cou...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2024-2424)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300032.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2424 advisory. 2024-02-29: CVE-2023-47108 was added to this advisory. The HTTP/2 protocol allows a denial of service...

Amazon Linux AMI : kernel (ALAS-2024-1906)

The version of kernel installed on the remote host is prior to 4.14.336-178.554. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1906 advisory. An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue coul...

Amazon Linux 2 : c-ares (ALAS-2024-2429)

The version of c-ares installed on the remote host is prior to 1.10.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2429 advisory. When cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will not be set, as seen when cross compiling...

Amazon Linux 2 : uriparser (ALAS-2024-2430)

The version of uriparser installed on the remote host is prior to 0.7.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2430 advisory. An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-488)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-488 advisory. In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: disable sending iouring over sockets CVE-2023-52654 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2 : GraphicsMagick (ALASGRAPHICSMAGICK1.3-2023-001)

The version of GraphicsMagick installed on the remote host is prior to 1.3.38-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2GRAPHICSMAGICK1.3-2023-001 advisory. In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. CVE-2022-1270 Tenable has extracted...

Amazon Linux 2 : vsftpd (ALAS-2024-2431)

The version of vsftpd installed on the remote host is prior to 3.0.2-25. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2431 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using...

Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2024-490)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-490 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make...

Amazon Linux 2 : webkitgtk4 (ALAS-2024-2425)

The version of webkitgtk4 installed on the remote host is prior to 2.42.4-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2425 advisory. The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2...