Medium: libreswan

Issue Overview: The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not...

Important: gstreamer1-plugins-base

Issue Overview: GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack...

Important: gstreamer-plugins-base

Issue Overview: GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack...

Amazon Linux 2 : kernel, --advisory ALAS2-2024-2588 (ALAS-2024-2588)

The version of kernel installed on the remote host is prior to 4.14.344-262.563. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2588 advisory. kernel: Type confusion in picknextrtentity, which can result in memory corruption. CVE-2023-1077 In the Linux...

Amazon Linux 2 : ipa (ALAS-2024-2585)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2585 advisory. A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client's session key. This key is different for each new session, which protects it from brute force attacks...

Amazon Linux 2 : R (ALASR3.4-2024-001)

The version of R installed on the remote host is prior to 3.4.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2R3.4-2024-001 advisory. Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not...

Amazon Linux 2 : thunderbird (ALAS-2024-2583)

The version of thunderbird installed on the remote host is prior to 115.12.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2583 advisory. Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of...

Amazon Linux 2 : kernel (ALAS-2024-2584)

The version of kernel installed on the remote host is prior to 4.14.345-262.561. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2584 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow timeout for...

Amazon Linux 2 : pki-core (ALAS-2024-2586)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2586 advisory. A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=, an attacker can authenticate with an...

Amazon Linux 2 : kernel (ALAS-2024-2589)

The version of kernel installed on the remote host is prior to 4.14.348-265.565. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2589 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Disable kvmclock on all CPUs on shutdown...

Amazon Linux 2 : harfbuzz (ALAS-2024-2587)

The version of harfbuzz installed on the remote host is prior to 1.7.5-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2587 advisory. hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger On^2 growth via consecutive marks during the proces...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-074)

The version of kernel installed on the remote host is prior to 5.4.277-190.375. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-074 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix bugon in estreesearch...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-026)

The version of firefox installed on the remote host is prior to 115.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-026 advisory. RESERVEDNOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2022-30/CVE-2022-2205 CVE-2022-2205 An attack...

Important: pki-core

Issue Overview: A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Disable kvmclock on all CPUs on shutdown CVE-2021-47110 In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Teardown PV features on boot CPU as well CVE-2021-47112 Affected...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-063)

The version of kernel installed on the remote host is prior to 5.10.219-208.866. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2024-063 advisory. In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race CVE-2024-3697...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race CVE-2024-36971 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.10 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and...

Amazon Linux 2 : unbound (ALASUNBOUND-1.17-2024-002)

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-1.17-2024-002 advisory. A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound gro...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-073)

The version of kernel installed on the remote host is prior to 5.4.149-73.259. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-073 advisory. A flaw was found in the Linux kernel. When reusing a socket with an attached dccpshctxccid as a listener, t...

Amazon Linux 2 : dnsmasq (ALAS-2024-2580)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2580 advisory. dnsmasq 2.9 is vulnerable to Integer Overflow via forwardquery. CVE-2023-49441 Tenable has extracted the preceding description bloc...