Amazon Linux 2023 : libwebp, libwebp-devel, libwebp-java (ALAS2023-2023-355)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-355 advisory. With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap. The ReadHuffmanCodes function allocates the HuffmanCode buffer with a size that comes from an array of...

Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2023-359)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-359 advisory. A flaw was found in glibc. When the getaddrinfo function is called with the AFUNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP...

Amazon Linux 2023 : libtommath, libtommath-devel (ALAS2023-2023-370)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-370 advisory. Integer Overflow vulnerability in mpgrow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service DoS...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-360)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-360 advisory. Use After Free in GitHub repository vim/vim prior to 9.0.1840. CVE-2023-4733 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. CVE-2023-4734 Out-of-bounds Write in...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-368)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-368 advisory. HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1NOTE: https://curl.se/docs/CVE-2023-38039.htmlNOTE: Introduced by:...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-369)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-369 advisory. Visual Studio Remote Code Execution Vulnerability CVE-2023-36792 Visual Studio Remote Code Execution Vulnerability CVE-2023-36793 Visual Studio Remote Code Execution Vulnerability CVE-2023-3679...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-365)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-365 advisory. URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through...

Amazon Linux 2023 : nerdctl (ALAS2023-2023-366)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-366 advisory. Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Tenable has extracted the precedi...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-362)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-362 advisory. In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer...

Amazon Linux 2023 : libwebp, libwebp-devel, libwebp-java (ALAS2023-2023-358)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-358 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2023-013 (ALASFIREFOX-2023-013)

The version of firefox installed on the remote host is prior to 102.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-013 advisory. Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian...

Amazon Linux 2 : microvm-kernel (ALASMICROVM-KERNEL-4.14-2023-003)

The version of microvm-kernel installed on the remote host is prior to 4.14.246-200.474. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MICROVM-KERNEL-4.14-2023-003 advisory. A flaw was found in the Linux kernel's implementation of wireless drivers using the...

Amazon Linux 2 : python38 (ALASPYTHON3.8-2023-002)

The version of python38 installed on the remote host is prior to 3.8.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2023-002 advisory. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing so...

Amazon Linux 2 : ruby (ALASRUBY3.0-2023-007)

The version of ruby installed on the remote host is prior to 3.0.1-148. It is, therefore, affected by a vulnerability as referenced in the ALAS2RUBY3.0-2023-007 advisory. A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using REXML...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-015)

The version of tomcat installed on the remote host is prior to 8.5.93-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-015 advisory. URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-008)

The version of firefox installed on the remote host is prior to 102.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-008 advisory. The Mozilla Foundation Security Advisory describes this flaw as: An attacker who compromised a content process cou...

Amazon Linux 2 : squid (ALASSQUID4-2023-005)

The version of squid installed on the remote host is prior to 4.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2SQUID4-2023-005 advisory. A flaw was found in squid. Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smugglin...

Amazon Linux 2 : ansible (ALASANSIBLE2-2023-005)

The version of ansible installed on the remote host is prior to 2.9.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-005 advisory. A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when...

Amazon Linux 2 : ruby (ALASRUBY3.0-2023-005)

The version of ruby installed on the remote host is prior to 3.0.2-149. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY3.0-2023-005 advisory. An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2023-003)

The version of postgresql installed on the remote host is prior to 14.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2023-003 advisory. IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or...