Amazon Linux 2 : vte291 (ALAS-2024-2610)

The version of vte291 installed on the remote host is prior to 0.52.2-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2610 advisory. GNOME VTE before 0.76.3 allows an attacker to cause a denial of service memory consumption via a window resize escape sequence, a...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-067)

The version of kernel installed on the remote host is prior to 5.10.216-204.855. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-067 advisory. In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify a...

Amazon Linux 2 : freeradius (ALAS-2024-2611)

The version of freeradius installed on the remote host is prior to 3.0.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2611 advisory. RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-068)

The version of kernel installed on the remote host is prior to 5.10.215-203.850. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-068 advisory. In the Linux kernel, the following vulnerability has been resolved: block: add check that partition leng...

Amazon Linux 2 : ca-certificates (ALAS-2024-2607)

The version of ca-certificates installed on the remote host is prior to 2023.2.68-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2607 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2024-042)

The version of containerd installed on the remote host is prior to 1.7.20-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2024-042 advisory. 2024-08-27: CVE-2024-24790 was added to this advisory. 2024-08-09: CVE-2023-47108 was removed from this...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-049 (ALASKERNEL-5.15-2024-049)

The version of kernel installed on the remote host is prior to 5.15.156-102.160. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-049 advisory. In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix panic when DSA master...

Amazon Linux 2 : thunderbird (ALAS-2024-2617)

The version of thunderbird installed on the remote host is prior to 115.12.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2617 advisory. A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured...

Amazon Linux 2 : ghostscript (ALAS-2024-2614)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2614 advisory. Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in t...

Amazon Linux 2 : kernel, --advisory ALAS2-2024-2615 (ALAS-2024-2615)

The version of kernel installed on the remote host is prior to 4.14.345-262.561. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2615 advisory. In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars...

Amazon Linux 2 : httpd (ALAS-2024-2606)

The version of httpd installed on the remote host is prior to 2.4.62-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2606 advisory. A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based...

Amazon Linux 2 : emacs (ALAS-2024-2608)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2608 advisory. In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30203 In Emacs before 29.3, LaTeX preview is...

Amazon Linux 2 : kernel (ALAS-2024-2613)

The version of kernel installed on the remote host is prior to 4.14.349-266.564. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2613 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlanroutev6outbound helper...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-048)

The version of kernel installed on the remote host is prior to 5.15.158-103.164. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-048 advisory. In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify a...

Amazon Linux 2 : gtk3 (ALAS-2024-2602)

The version of gtk3 installed on the remote host is prior to 3.22.30-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2602 advisory. gtk3: gtk2: Library injection from CWD CVE-2024-6655 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-077 (ALASKERNEL-5.4-2024-077)

The version of kernel installed on the remote host is prior to 5.4.278-191.377. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-077 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug...

Amazon Linux 2 : bind (ALAS-2024-2616)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2616 advisory. Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname of any RTYPE...

Amazon Linux 2 : openssl11 (ALAS-2024-2621)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2621 advisory. openssl: Use After Free with SSLfreebuffers CVE-2024-4741 Issue summary: Calling the OpenSSL API function...

Medium: thunderbird

Issue Overview: A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above CVE-2023-6349 Affected Packages: thunderbird Note:...

Important: gtk2

Issue Overview: gtk3: gtk2: Library injection from CWD CVE-2024-6655 Affected Packages: gtk2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update gtk2 to upda...