Medium: qt5-qtbase

Issue Overview: In QT, there is an integer overflow in qfixedp.h when rendering SVG image on the minimal plugin. CVE-2023-32763 Affected Packages: qt5-qtbase Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...

Medium: libicu60

Issue Overview: International Components for Unicode ICU-20850 v66.1 was discovered to contain a use after free bug in the pkgcreateWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. CVE-2020-21913 Affected Packages: libicu60 Note: This advisory is applicable to Amazon Linux 2 AL2...

Medium: samba

Issue Overview: A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file or printer instead of client-supplied data. The client cannot control th...

Important: apache-ivy

Issue Overview: When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which ar...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2023-007)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0382.b05-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2023-007 advisory. Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affecte...

Amazon Linux 2 : python-pip (ALAS-2023-2151)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2151 advisory. A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and IPv6Interface classes. This flaw allows an attacker to create many dictionary entries, due to...

Amazon Linux 2 : python3-tornado (ALAS-2023-2133)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2133 advisory. Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a us...

Amazon Linux 2 : libmicrohttpd (ALAS-2023-2135)

The version of libmicrohttpd installed on the remote host is prior to 0.9.33-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2135 advisory. GNU libmicrohttpd before 0.9.76 allows remote DoS Denial of Service due to improper parsing of a multipart/form-data boundar...

Amazon Linux 2 : python-rsa (ALAS-2023-2150)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2150 advisory. A flaw was found in python-rsa, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. Th...

Amazon Linux 2 : ImageMagick (ALAS-2023-2128)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2128 advisory. stack overflow when parsing malicious tiff image CVE-2023-3195 Tenable has extracted the preceding description block direct...

Amazon Linux 2 : tcpdump (ALAS-2023-2119)

The version of tcpdump installed on the remote host is prior to 4.9.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2119 advisory. The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrpprint for VRRP version 3, a different...

Amazon Linux 2 : libtiff (ALAS-2023-2126)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2126 advisory. A NULL pointer dereference in TIFFClose is caused by a failure to open an output file non-existent path or a path that requires...

Amazon Linux 2 : gstreamer-plugins-good (ALAS-2023-2122)

The version of gstreamer-plugins-good installed on the remote host is prior to 0.10.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2122 advisory. Integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2114)

The version of open-vm-tools installed on the remote host is prior to 12.1.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2114 advisory. VMware Tools 12.0.0, 11.x.y and 10.x.y contains a local privilege escalation vulnerability. A malicious actor with local...

Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2023-2120)

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2120 advisory. Heap overwrite in subtitle parsing CVE-2023-37328 Tenable has extracted the preceding description block directly...

Amazon Linux 2 : rclone (ALAS-2023-2143)

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2143 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block...

Amazon Linux 2 : wireshark (ALAS-2023-2113)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2113 advisory. Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an...

Amazon Linux 2 : cups (ALAS-2023-2109)

The version of cups installed on the remote host is prior to 1.6.3-51. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2109 advisory. A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection h...

Amazon Linux 2 : python-requests (ALAS-2023-2110)

The version of python-requests installed on the remote host is prior to 2.6.0-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2110 advisory. A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy- Authorization header...

Amazon Linux 2 : libX11 (ALAS-2023-2129)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2129 advisory. A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the...