Important: unbound

Issue Overview: Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses when there is a zone with many DNSKEY and RRSIG records, aka the "KeyTrap" issue. The protocol specification...

Important: shim

Issue Overview: A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive...

Amazon Linux AMI : sudo (ALAS-2024-1922)

The version of sudo installed on the remote host is prior to 1.8.23-10.59. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1922 advisory. 2024-06-07: CVE-2024-31969 was added to this advisory. In sudo-1.8.23-10.amzn2.3.6 Amazon Linux 2 and sudo-1.8.23-10.58.amzn1 Amaz...

Amazon Linux 2 : sudo (ALAS-2024-2473)

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2473 advisory. 2024-06-06: CVE-2024-31969 was added to this advisory. In sudo-1.8.23-10.amzn2.3.6 Amazon Linux 2 and sudo-1.8.23-10.58.amzn1 Amazon...

Important: sudo

Issue Overview: In sudo-1.8.23-10.amzn2.3.6 Amazon Linux 2 and sudo-1.8.23-10.58.amzn1 Amazon Linux 1, a user with an entry in the sudoers file, enabling them to run commands as another unprivileged user, can leverage it to run commands as root. No prior versions are affected. This issue has been...

Important: sudo

Issue Overview: In sudo-1.8.23-10.amzn2.3.6 Amazon Linux 2 and sudo-1.8.23-10.58.amzn1 Amazon Linux 1, a user with an entry in the sudoers file, enabling them to run commands as another unprivileged user, can leverage it to run commands as root. No prior versions are affected. This issue has been...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-520)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-520 advisory. A flaw was found in OpenSSL. When the EVPPKEYpubliccheck function is called in RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is ...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2024-523)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-523 advisory. Multiple NSS NIST curves were susceptible to a side-channel attack known as Minerva. This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox 121...

Amazon Linux 2 : atril (ALASMATE-DESKTOP1.X-2024-006)

The version of atril installed on the remote host is prior to 1.20.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2MATE-DESKTOP1.X-2024-006 advisory. Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-038)

The version of kernel installed on the remote host is prior to 5.15.148-97.161. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-038 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to...

Amazon Linux 2023 : opensc (ALAS2023-2024-534)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-534 advisory. A heap use after free issue was found in Opensc before version 0.22.0 in scfilevalid. CVE-2021-42779 Tenable has extracted the preceding description block directly from the tested product security...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-060)

The version of kernel installed on the remote host is prior to 5.4.268-181.370. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2024-060 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve loca...

Amazon Linux 2023 : runc (ALAS2023-2024-531)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-531 advisory. runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where runc exec --cap created processes with non-empty...

Amazon Linux 2023 : GraphicsMagick, GraphicsMagick-c++, GraphicsMagick-c++-devel (ALAS2023-2024-532)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-532 advisory. Buffer Overflow vulnerability in WritePCXImage function in pcx.c in GraphicsMagick 1.4 allows remote attackers to cause a denial of service via converting of crafted image file to pcx format...

Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2024-521)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-521 advisory. A vulnerability was found in GnuTLS, where a cockpit which uses gnuTLS rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with...

Amazon Linux 2023 : graphviz, graphviz-devel, graphviz-gd (ALAS2023-2024-527)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-527 advisory. buffer overflow via a crafted config6a file NOTE: Crosses no security boundary, config files are under local controlNOTE: https://gitlab.com/graphviz/graphviz/-/issues/2441NOTE: Introduced by:...

Low: containerd

Issue Overview: Containerd is not affected by CVE-2023-39325. While it contains the affected module, it does not use it in a way that exposes users to CVE-2023-39325. Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to learn...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2024-536)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-536 advisory. Vim before 9.0.2142 has a stack-based buffer overflow because didsetlangmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions. CVE-2024-22667 Tenab...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2024-525)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-525 advisory. A segment fault SEGV flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt API. This flaw allows a remote attacker to cause a heap-buffer overflow,...

Amazon Linux 2 : containerd (ALASDOCKER-2024-038)

The version of containerd installed on the remote host is prior to 1.6.28-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2024-038 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many...