Important: python-pillow

Issue Overview: Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed. CVE-2014-9601 Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted...

Medium: mod_auth_mellon

Issue Overview: A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. T...

Important: glusterfs

Issue Overview: In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. CVE-2023-26253 Affected Packages: glusterfs Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between A...

Medium: rsync

Issue Overview: A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large gzip header extra field. This flaw is only applicable in the call inflateGetHeader. CVE-2022-37434 Affected Packages: rsync Note: This advisory is...

Amazon Linux 2 : runc (ALASDOCKER-2023-025)

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-025 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-020)

The version of kernel installed on the remote host is prior to 5.15.110-70.143. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-020 advisory. A denial of service problem was found, due to a possible recursive locking scenario, resulting in a...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-033)

The version of kernel installed on the remote host is prior to 5.10.179-168.710. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-033 advisory. A denial of service problem was found, due to a possible recursive locking scenario, resulting in a...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-019 (ALASKERNEL-5.15-2023-019)

The version of kernel installed on the remote host is prior to 5.15.104-63.140. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-019 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: block range must be validated...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-046)

The version of kernel installed on the remote host is prior to 5.4.242-156.349. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2023-046 advisory. In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2023-004)

The version of java-11-openjdk installed on the remote host is prior to 11.0.19.0.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2023-004 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java S...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2023-024)

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-024 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions ...

Amazon Linux 2 : squid (ALAS-2023-2065)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2065 advisory. An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP...

Amazon Linux 2 : qemu (ALAS-2023-2060)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2060 advisory. An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits tx descriptors in...

Amazon Linux 2 : libtiff (ALAS-2023-2055)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2055 advisory. It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose at tifclose.c:131 called by...

Amazon Linux 2 : kernel (ALAS-2023-2050)

The version of kernel installed on the remote host is prior to 4.14.314-238.539. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2050 advisory. In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to...

Amazon Linux 2 : microcode_ctl (ALAS-2023-2056)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2056 advisory. 2024-05-09: CVE-2022-33196 was added to this advisory. Insufficient granularity of access control in out-of-band...

Amazon Linux 2 : squid (ALAS-2023-2062)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2062 advisory. An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in...

Amazon Linux 2 : thunderbird (ALAS-2023-2051)

The version of thunderbird installed on the remote host is prior to 102.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2051 advisory. In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to...

Amazon Linux 2 : tar (ALAS-2023-2064)

The version of tar installed on the remote host is prior to 1.26-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2064 advisory. paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed...

Amazon Linux 2 : glib2 (ALAS-2023-2058)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2058 advisory. A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged...