Amazon Linux AMI : sssd (ALAS-2023-1723)

The version of sssd installed on the remote host is prior to 1.16.4-21.27. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1723 advisory. A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and...

Amazon Linux AMI : vim (ALAS-2023-1716)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1716 advisory. A heap buffer overflow vulnerability was found in vim's inscomplinfercasegettext function of the src/insexpand.c file. This flaw occurs when vim tries to access uninitialized memory when completin...

Amazon Linux AMI : yasm (ALAS-2023-1724)

The version of yasm installed on the remote host is prior to 1.2.0-1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1724 advisory. An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasmexprgetintnum in libyasm/expr.c...

Amazon Linux AMI : exim (ALAS-2023-1722)

The version of exim installed on the remote host is prior to 4.92-1.36. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1722 advisory. The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending. CVE-2021-38371 Tenable has...

Amazon Linux AMI : microcode_ctl (ALAS-2023-1715)

The version of microcodectl installed on the remote host is prior to 2.1-47.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1715 advisory. 2024-02-14: CVE-2022-38090 was added to this advisory. 2024-02-01: CVE-2022-21216 was added to this advisory...

Amazon Linux AMI : python-twisted-web (ALAS-2023-1717)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1717 advisory. A flaw was found in python-twisted. This vulnerability occurs due to the parsing of illegal constructs in the twisted.web.http module. The illegal constructs include '+/-' in the Content-Length...

Amazon Linux AMI : python38 (ALAS-2023-1714)

The version of python38 installed on the remote host is prior to 3.8.5-1.9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1714 advisory. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing...

Amazon Linux AMI : python27 (ALAS-2023-1713)

The version of python27 installed on the remote host is prior to 2.7.18-2.145. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1713 advisory. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processin...

Amazon Linux AMI : emacs (ALAS-2023-1712)

The version of emacs installed on the remote host is prior to 24.3-20.25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1712 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,...

Amazon Linux AMI : kernel (ALAS-2023-1707)

The version of kernel installed on the remote host is prior to 4.14.301-153.528. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1707 advisory. 2024-06-07: CVE-2023-26607 was added to this advisory. A vulnerability was found in Linux Kernel. It has been...

Amazon Linux AMI : httpd24 (ALAS-2023-1711)

The version of httpd24 installed on the remote host is prior to 2.4.56-1.100. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1711 advisory. A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory...

Amazon Linux AMI : dnsmasq (ALAS-2020-1458)

The version of dnsmasq installed on the remote host is prior to 2.76-16.16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1458 advisory. A flaw was found in the Dnsmasq application where a remote attacker can trigger a memory leak by sending specially crafted DHCP...

Amazon Linux AMI : lighttpd (ALAS-2023-1705)

The version of lighttpd installed on the remote host is prior to 1.4.53-1.37. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1705 advisory. In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request websocket handshake i...

Amazon Linux AMI : kernel (ALAS-2023-1706)

The version of kernel installed on the remote host is prior to 4.14.305-155.531. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1706 advisory. Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interfac...

Amazon Linux AMI : vim (ALAS-2023-1703)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1703 advisory. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. CVE-2023-0288 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. CVE-2023-0433 Divide By Zero in...

Amazon Linux AMI : kernel (ALAS-2023-1701)

The version of kernel installed on the remote host is prior to 4.14.309-159.529. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1701 advisory. Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as well as...

Amazon Linux AMI : tar (ALAS-2023-1704)

The version of tar installed on the remote host is prior to 1.26-31.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1704 advisory. GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitati...

Amazon Linux AMI : freeradius (ALAS-2023-1699)

The version of freeradius installed on the remote host is prior to 2.2.6-7.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1699 advisory. When an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionarie...

Amazon Linux AMI : batik (ALAS-2023-1695)

The version of batik installed on the remote host is prior to 1.7-10.10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1695 advisory. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2023-1697)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.362.b08-1.72. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1697 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...