Amazon Linux 2 : oci-add-hooks (ALASDOCKER-2024-042)

The version of oci-add-hooks installed on the remote host is prior to 0-0.2.20200504git325a340. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2024-042 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessi...

Medium: apache-commons-compress

Issue Overview: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package...

Low: cups

Issue Overview: A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with...

Amazon Linux 2 : containerd, --advisory ALAS2ECS-2024-040 (ALASECS-2024-040)

The version of containerd installed on the remote host is prior to 1.7.20-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-040 advisory. The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This...

Medium: kernel

Issue Overview: A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function tcpgetsockopt/tcpsetsockopt of the component TCP Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. The identifier...

Medium: apache-commons-compress

Issue Overview: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-027)

The version of firefox installed on the remote host is prior to 115.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-027 advisory. A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally...

Amazon Linux 2 : ghostscript (ALAS-2024-2612)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2612 advisory. NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.htmlNOTE: https://cgit.ghostscript.com/cgi-...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-078)

The version of kernel installed on the remote host is prior to 5.4.275-189.375. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-078 advisory. A flaw was found in the smb client in the Linux kernel. A potential out-of-bounds error was seen in the...

Amazon Linux 2 : python-lxml (ALAS-2024-2620)

The version of python-lxml installed on the remote host is prior to 3.2.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2620 advisory. An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and...

Amazon Linux 2 : openssl (ALAS-2024-2604)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2604 advisory. Issue summary: Calling the OpenSSL API function SSLselectnextproto with anempty supported client protocols buffer may cause a cra...

Amazon Linux 2 : openssl11 (ALAS-2024-2605)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2605 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-050 (ALASKERNEL-5.15-2024-050)

The version of kernel installed on the remote host is prior to 5.15.164-108.161. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-050 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a use-after-free...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2024-020)

The version of tomcat installed on the remote host is prior to 8.5.100-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2024-020 advisory. Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When...

Amazon Linux 2 : protobuf-c (ALAS-2024-2619)

The version of protobuf-c installed on the remote host is prior to 1.0.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2619 advisory. Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parsetagandwiretype in...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-047)

The version of kernel installed on the remote host is prior to 5.15.161-106.159. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-047 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input cor...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-066 (ALASKERNEL-5.10-2024-066)

The version of kernel installed on the remote host is prior to 5.10.223-211.872. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-066 advisory. A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the functi...

Amazon Linux 2 : containerd (ALASDOCKER-2024-041)

The version of containerd installed on the remote host is prior to 1.7.20-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2024-041 advisory. 2024-08-27: CVE-2024-24790 was added to this advisory. 2024-08-14: CVE-2023-47108 was removed from this advisory...

Amazon Linux 2 : nerdctl (ALAS-2024-2618)

The version of nerdctl installed on the remote host is prior to 1.7.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2618 advisory. 2024-08-28: CVE-2024-24790 was added to this advisory. A malicious HTTP sender can use chunk extensions to cause a receive...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-079)

The version of kernel installed on the remote host is prior to 5.4.274-187.369. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-079 advisory. In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleti...