Amazon Linux 2 : python-lxml (ALAS-2023-1956)

The version of python-lxml installed on the remote host is prior to 3.2.1-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1956 advisory. Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to condu...

Amazon Linux 2 : squid (ALAS-2023-1950)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1950 advisory. An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of...

Amazon Linux 2 : nss-util (ALAS-2023-1954)

The version of nss-util installed on the remote host is prior to 3.67.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1954 advisory. NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

Critical: clamav

Issue Overview: Possible remote code execution vulnerability in the ClamAV HFS+ file parser. The issue affects ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. CVE-2023-20032 A possible remote information leak vulnerability in the DMG file parser. The issue affects...

Medium: httpcomponents-client

Issue Overview: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. CVE-2020-13956 Affected Packages: httpcomponents-client...

Medium: postgresql

Issue Overview: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and...

Important: webkitgtk4

Issue Overview: A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2022-42823 Affected...

Important: python-lxml

Issue Overview: Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function. CVE-2014-3146 An issue was discovered in lxml before 4.2.5...

Important: libXpm

Issue Overview: A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. CVE-2022-44617 A flaw was found ...

Amazon Linux 2 : apr-util, apr-util-bdb, apr-util-devel (ALAS-2023-1937)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1937 advisory. Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable...

Amazon Linux 2 : apr, apr-devel (ALAS-2023-1936)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1936 advisory. An out-of-bounds array read in the aprtimeexp functions was fixed in the Apache Portable Runtime 1.6.3 release CVE-2017-12613. The fix for this issue was not carried forward to the APR 1.7.x...

Amazon Linux 2 : kernel, --advisory ALAS2-2023-1932 (ALAS-2023-1932)

The version of kernel installed on the remote host is prior to 4.14.304-226.531. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1932 advisory. Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interfa...

Amazon Linux 2 : openssl11 (ALAS-2023-1934)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1934 advisory. A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover ...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-026 (ALASKERNEL-5.10-2023-026)

The version of kernel installed on the remote host is prior to 5.10.165-143.735. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-026 advisory. In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-013 (ALASKERNEL-5.15-2023-013)

The version of kernel installed on the remote host is prior to 5.15.90-54.138. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-013 advisory. In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows a...

Amazon Linux 2 : curl, libcurl, libcurl-devel (ALAS-2023-1924)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1924 advisory. A vulnerability was found in curl. This issue occurs due to an erroneous function. A malicious server could make curl within Network Security Services NSS get stuck in a never-ending busy loop wh...

Amazon Linux 2 : git, git-all, git-core (ALAS-2023-1923)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1923 advisory. Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository...

Amazon Linux 2 : protobuf, protobuf-compiler, protobuf-devel (ALAS-2023-1931)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1931 advisory. A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute...

Amazon Linux 2 : sysstat (ALAS-2023-1925)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1925 advisory. sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocatestructures contains a sizet overflow in sacommon.c...

Amazon Linux 2 : autotrace, autotrace-devel (ALAS-2023-1929)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1929 advisory. Heap-based buffer overflow in the pstoeditsuffixtableinit function in output-pstoedit.c in AutoTrace 0.31.1 allows remote attackers to cause a denial of service out-of-bounds write via a crafted...