Amazon Linux 2 : jettison (ALAS-2023-2053)

The version of jettison installed on the remote host is prior to 1.3.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2053 advisory. An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in o...

Amazon Linux 2 : golang (ALAS-2023-2052)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2052 advisory. html/template: improper sanitization of CSS values Angle brackets were not considered dangerous characters when inserted into CSS...

Amazon Linux 2 : fribidi (ALAS-2023-2054)

The version of fribidi installed on the remote host is prior to 1.0.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2054 advisory. A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidicaprtltounicode function of the...

Amazon Linux 2 : mariadb (ALAS-2023-2057)

The version of mariadb installed on the remote host is prior to 5.5.68-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2057 advisory. getsortbytable in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. CVE-2021-46657...

Amazon Linux 2 : libplist (ALAS-2023-2067)

The version of libplist installed on the remote host is prior to 1.12-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2067 advisory. A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plistfromxml of the fil...

Important: squid

Issue Overview: An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in extlmgroupacl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being...

Medium: glib2

Issue Overview: A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition. CVE-2021-3800 Affected Packages: glib2 Note: This advisory is applicable to Amazon Linux 2 AL2...

Low: qemu

Issue Overview: An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits tx descriptors in processtxdesc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulti...

Important: squid

Issue Overview: An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restrict...

Important: jettison

Issue Overview: An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown. CVE-2023-1436 Affected Packages: jettison Note: This advisory is...

Important: kernel

Issue Overview: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are...

Medium: apache-commons-io

Issue Overview: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus...

Amazon Linux 2 : libssh2 (ALAS-2023-2046)

The version of libssh2 installed on the remote host is prior to 1.4.3-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2046 advisory. An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the libssh2packetrequire and libssh2packetrequirev...

Amazon Linux 2 : kernel (ALAS-2023-2035)

The version of kernel installed on the remote host is prior to 4.14.314-237.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2035 advisory. A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra ino...

Amazon Linux 2 : golang (ALAS-2023-2037)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2037 advisory. HTTP and MIME header parsing could allocate large amounts of memory, even when parsing small inputs. Certain unusual patterns of...

Amazon Linux 2 : libwebp (ALAS-2023-2048)

The version of libwebp installed on the remote host is prior to 0.3.0-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2048 advisory. 2023-08-03: CVE-2018-25014 was added to this advisory. A heap-based buffer overflow was found in libwebp in versions befo...

Amazon Linux 2 : glib2 (ALAS-2023-2049)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2049 advisory. In GNOME GLib 2.56.1, gmarkupparsecontextendparse in gmarkup.c has a NULL pointer dereference. CVE-2018-16428 GNOME GLib...

Amazon Linux 2 : openssl11 (ALAS-2023-2039)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2039 advisory. A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509...

Amazon Linux 2 : inkscape (ALAS-2023-2043)

The version of inkscape installed on the remote host is prior to 0.92.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2043 advisory. Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2023-2038)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.372.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2038 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...