Amazon Linux 2 : clamav (ALAS-2024-2644)

The version of clamav installed on the remote host is prior to 0.103.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2644 advisory. A vulnerability in the PDF parsing module of Clam AntiVirus ClamAV versions 1.4.0, 1.3.2 and prior versions, all 1.2.x...

Amazon Linux 2 : python-setuptools (ALAS-2024-2641)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2641 advisory. A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from...

Amazon Linux 2 : kernel (ALAS-2024-2642)

The version of kernel installed on the remote host is prior to 4.14.352-268.568. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2642 advisory. In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2024-2645)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.859.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2645 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive...

Amazon Linux 2 : xerces-j2 (ALAS-2024-2649)

The version of xerces-j2 installed on the remote host is prior to 2.11.0-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2649 advisory. Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service CPU consumption via a crafted...

Amazon Linux 2 : python-pillow (ALAS-2024-2648)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2648 advisory. Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. CVE-2020-10177 Tenable has...

Amazon Linux 2 : python-dns (ALAS-2024-2647)

The version of python-dns installed on the remote host is prior to 1.12.0-4.20150617git465785f. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2647 advisory. eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS nam...

Amazon Linux 2 : golang (ALAS-2024-2643)

The version of golang installed on the remote host is prior to 1.22.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2643 advisory. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack...

Amazon Linux 2 : thunderbird (ALAS-2024-2640)

The version of thunderbird installed on the remote host is prior to 115.13.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2640 advisory. Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of...

Medium: python-pillow

Issue Overview: Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. CVE-2020-10177 Affected Packages: python-pillow Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2024-004)

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by a vulnerability as referenced in the ALAS2LIBREOFFICE-2024-004 advisory. Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts tha...

Medium: xerces-j2

Issue Overview: Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service CPU consumption via a crafted message to an XML service, which triggers hash table collisions. CVE-2012-0881 There's a vulnerability within the Apache Xerces Java XercesJ XML parser when...

Medium: python-dns

Issue Overview: eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2024-047)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.9.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2024-047 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6...

Amazon Linux 2 : libpq (ALASPOSTGRESQL12-2024-012)

The version of libpq installed on the remote host is prior to 12.20-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL12-2024-012 advisory. Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASECS-2024-043)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.9.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-043 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses,...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-071 (ALASKERNEL-5.10-2024-071)

The version of kernel installed on the remote host is prior to 5.10.225-213.878. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-071 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: don't allow mapping the...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2024-012)

The version of postgresql installed on the remote host is prior to 14.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-012 advisory. Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary...

Medium: c-ares

Issue Overview: Insufficient randomness in generation of DNS query IDs When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand so will generate predictable output. Input from th...

Amazon Linux 2 : redis (ALASREDIS6-2024-010)

The version of redis installed on the remote host is prior to 6.2.14-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2024-010 advisory. Denial-of-service due to unbounded pattern matching CVE-2024-31228 Lua library commands may be exploited by an...