Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-045)

The version of kernel installed on the remote host is prior to 5.10.205-195.804. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-045 advisory. A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel...

Amazon Linux 2 : curl (ALAS-2024-2385)

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2385 advisory. This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more origins than what is...

Amazon Linux 2 : snakeyaml (ALAS-2024-2403)

The version of snakeyaml installed on the remote host is prior to 1.11-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2403 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is runnin...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2024-2397)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.392.b08-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2397 advisory. Vulnerability in Oracle Java SE component: CORBA. Supported versions that are affected are Oracle Java...

Amazon Linux 2 : tar (ALAS-2024-2390)

The version of tar installed on the remote host is prior to 1.26-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2390 advisory. It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could supply a specially crafted file a...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2024-008)

The version of haproxy2 installed on the remote host is prior to 2.2.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2024-008 advisory. HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive...

Amazon Linux 2 : avahi (ALAS-2024-2393)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2393 advisory. A reachable assertion was found in avahirdataparse. CVE-2023-38472 Tenable has extracted the preceding description block directly...

Amazon Linux 2 : squid (ALAS-2024-2382)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2382 advisory. 2024-02-29: CVE-2024-25617 was added to this advisory. 2024-02-29: CVE-2023-49285 was removed from this advisory. 2024-02-29: The...

Amazon Linux 2 : dmidecode (ALAS-2024-2395)

The version of dmidecode installed on the remote host is prior to 3.2-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2395 advisory. Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of...

Amazon Linux 2 : ncurses (ALAS-2024-2412)

The version of ncurses installed on the remote host is prior to 6.0-8.20170212. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2412 advisory. There is a heap-based buffer over-read in the ncfindentry function in tinfo/comphash.c in the terminfo library in...

Amazon Linux 2 : perl-HTTP-Daemon (ALAS-2024-2405)

The version of perl-HTTP-Daemon installed on the remote host is prior to 6.01-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2405 advisory. HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which cou...

Amazon Linux 2 : qpdf (ALAS-2024-2409)

The version of qpdf installed on the remote host is prior to 5.0.1-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2409 advisory. 2024-01-17: CVE-2021-36978 was added to this advisory. An issue was discovered in QPDF version 10.0.4, allows remote attacker...

Amazon Linux 2 : c-ares (ALAS-2024-2399)

The version of c-ares installed on the remote host is prior to 1.10.0-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2399 advisory. A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Serve...

Amazon Linux 2 : python-ldap (ALAS-2024-2406)

The version of python-ldap installed on the remote host is prior to 2.4.15-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2406 advisory. python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, becau...

Amazon Linux 2 : thunderbird (ALAS-2024-2377)

The version of thunderbird installed on the remote host is prior to 115.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2377 advisory. The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time...

Amazon Linux 2 : python-pillow (ALAS-2024-2413)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2413 advisory. Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the crafted image...

Amazon Linux 2 : libsass (ALASMATE-DESKTOP1.X-2024-004)

The version of libsass installed on the remote host is prior to 3.6.4-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MATE-DESKTOP1.X-2024-004 advisory. Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::hasrealparentref function...

Amazon Linux 2 : kernel (ALAS-2024-2391)

The version of kernel installed on the remote host is prior to 4.14.334-252.552. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2391 advisory. 2024-12-05: CVE-2023-52809 was added to this advisory. 2024-12-05: CVE-2023-52759 was added to this advisory...

Amazon Linux 2 : python (ALAS-2024-2400)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2400 advisory. An issue was discovered in comparedigest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possibl...

Amazon Linux 2 : xorg-x11-server (ALAS-2024-2378)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2378 advisory. A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local...