Important: golang

Issue Overview: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. CVE-2024-34155 Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-086 (ALASKERNEL-5.4-2024-086)

The version of kernel installed on the remote host is prior to 5.4.284-196.380. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-086 advisory. In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's...

Amazon Linux 2 : php (ALASPHP8.2-2024-005)

The version of php installed on the remote host is prior to 8.2.23-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.2-2024-005 advisory. In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as...

Amazon Linux 2 : python38-setuptools (ALASPYTHON3.8-2024-012)

The version of python38-setuptools installed on the remote host is prior to 38.4.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2024-012 advisory. A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-070 (ALASKERNEL-5.10-2024-070)

The version of kernel installed on the remote host is prior to 5.10.226-214.879. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-070 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xen/events: close evtchn after mapping cleanup CVE-2024-26687 In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize CVE-2024-35807 Affected Packages: kernel...

Amazon Linux 2 : microcode_ctl (ALAS-2024-2635)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2635 advisory. 2024-10-10: CVE-2024-22374 was added to this advisory. Improper isolation in some IntelR Processors stream cache...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-029)

The version of firefox installed on the remote host is prior to 115.15.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-029 advisory. 2024-09-26: CVE-2024-7652 was added to this advisory. An error in the ECMA-262 specification relating to Async...

Amazon Linux 2 : systemd (ALAS-2024-2636)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2636 advisory. An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize CVE-2024-35807 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about Amazon Linux 2 AL2...

Important: kernel-livepatch-5.10.220-209.869

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix double free on error CVE-2024-41087 Affected Packages: kernel-livepatch-5.10.220-209.869 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Amazon Linux 2 : kernel (ALAS-2024-2633)

The version of kernel installed on the remote host is prior to 4.14.336-257.566. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2633 advisory. 2024-12-05: CVE-2024-26687 was added to this advisory. In the Linux kernel, the following vulnerability has been...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-052)

The version of kernel installed on the remote host is prior to 5.15.166-111.163. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-052 advisory. 2024-09-26: CVE-2024-46763 was added to this advisory. 2024-09-26: CVE-2024-46707 was added to this...

Amazon Linux 2 : ruby (ALAS-2024-2637)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2637 advisory. A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-054)

The version of kernel installed on the remote host is prior to 5.15.149-99.162. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2024-054 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2024-006)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2OPENSSL-SNAPSAFE-2024-006 advisory. Issue summary: Calling the OpenSSL API function SSLselectnextproto with anempty supported client protocol...

Medium: ruby

Issue Overview: A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using REXML and writing parsed data back to a new XML document results in creating a document with a different structure. This issue could affect the integrity of...

Amazon Linux 2 : ruby (ALAS-2024-2634)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2634 advisory. ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 Tenable has extracted the preceding description block directly...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-053 (ALASKERNEL-5.15-2024-053)

The version of kernel installed on the remote host is prior to 5.15.162-107.160. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-053 advisory. A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the functi...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-084 (ALASKERNEL-5.4-2024-084)

The version of kernel installed on the remote host is prior to 5.4.279-193.377. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-084 advisory. A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function...