Amazon Linux 2 : libuv (ALAS-2024-2410)

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2410 advisory. Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii is used to convert strings to ASCI...

Amazon Linux 2 : binutils (ALAS-2024-2401)

The version of binutils installed on the remote host is prior to 2.29.1-31. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2401 advisory. A memory consumption issue in getdata function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denia...

Amazon Linux 2 : jetty (ALAS-2024-2408)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2408 advisory. For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example...

Amazon Linux 2 : bluez (ALAS-2024-2386)

The version of bluez installed on the remote host is prior to 5.44-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2386 advisory. bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution CVE-2023-45866 Tenable has...

Amazon Linux 2 : ntp (ALAS-2024-2396)

The version of ntp installed on the remote host is prior to 4.2.8p15-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2396 advisory. 2024-02-15: CVE-2023-26555 was added to this advisory. mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds wri...

Amazon Linux 2 : avahi (ALAS-2024-2392)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2392 advisory. A reachable assertion was found in avahialternativehostname. CVE-2023-38473 Tenable has extracted the preceding description block...

Amazon Linux 2 : vim (ALAS-2024-2384)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2384 advisory. Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very first time and using a sub-replace-special atom inside the...

Amazon Linux 2 : ncurses (ALAS-2024-2380)

The version of ncurses installed on the remote host is prior to 6.0-8.20170212. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2380 advisory. NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component ncwrapentry. CVE-2023-50495 Tenable ha...

Amazon Linux 2 : virtuoso-opensource (ALAS-2024-2383)

The version of virtuoso-opensource installed on the remote host is prior to 7.2.11-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2383 advisory. An issue in the boxdiv function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of...

Amazon Linux 2 : xorg-x11-server (ALAS-2024-2378)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2378 advisory. A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local...

Amazon Linux 2 : ecs-init (ALASECS-2024-032)

The version of ecs-init installed on the remote host is prior to 1.75.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-032 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...

Amazon Linux 2 : libpq (ALASPOSTGRESQL12-2024-006)

The version of libpq installed on the remote host is prior to 12.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL12-2024-006 advisory. 2024-06-06: CVE-2023-5869 was removed from this advisory.2024-06-06: The severity of this advisory was modified from...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-057)

The version of kernel installed on the remote host is prior to 5.4.265-176.364. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-057 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: double hook...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-033 (ALASKERNEL-5.15-2024-033)

The version of kernel installed on the remote host is prior to 5.15.145-95.156. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-033 advisory. An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an...

Amazon Linux 2023 : jtidy, jtidy-javadoc (ALAS2023-2024-478)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-478 advisory. An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-34623 Tenable has extracted...

Medium: jtidy

Issue Overview: An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-34623 Affected Packages: jtidy Issue Correction: Run dnf update jtidy --releasever 2023.3.20240108 to updat...

Low: curl

Issue Overview: When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. CVE-2023-46219 Affected Packages: curl Issue Correction: Run dnf update curl --releasev...

Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2024-473)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-473 advisory. bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution CVE-2023-45866 Tenable has extracted the preceding description block directly from the tested produ...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2024-470)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-470 advisory. An issue was discovered in the function gdevprnopenprinterseekable in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer. CVE-2023-46751 Tenable...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-480)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-480 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now...