Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-406)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-406 advisory. A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. A truncati...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2023-408)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-408 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-416)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-416 advisory. Samba is vulnerable to path traversal due to insufficient sanitization of clients incoming pipe names. This can lead to the client connecting to as root to a Unix domain socket outside of the...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-405)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-405 advisory. RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file CVE-2023-5371 Tenable has extracted the preceding...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-420)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-420 advisory. An issue was found in libcurl which allows cookies to be inserted into a running program if specific conditions are met. The libcurl provided function, curleasyduphandle, is used to duplicate t...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2023-427)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-427 advisory. 2023-11-09: CVE-2023-22081 was added to this advisory. An issue was discovered in function ciMethodBlocks::makeblockat in Oracle JDK HotSpot VM 11, 17 and OpenJDK HotSpot VM 8, 11, 17, allows...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-422)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-422 advisory. 2024-07-03: CVE-2023-52522 was added to this advisory. 2024-07-03: CVE-2023-52559 was added to this advisory. 2024-07-03: CVE-2023-52523 was added to this advisory. 2024-06-06: CVE-2023-52481 w...

Amazon Linux 2023 : binutils, binutils-devel, binutils-gprofng (ALAS2023-2023-425)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-425 advisory. A potential illegal memory access in binutils has been found when parsing a corrupt file. CVE-2023-1579 Tenable has extracted the preceding description block directly from the tested product security...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-415)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-415 advisory. Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2023-418)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-418 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2023-411)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-411 advisory. libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think these issues...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2023-426)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-426 advisory. 2023-11-09: CVE-2023-22081 was added to this advisory. 2023-11-09: CVE-2023-22067 was added to this advisory. An issue was discovered in function ciMethodBlocks::makeblockat in Oracle JDK HotSp...

Amazon Linux 2023 : libvpx, libvpx-devel, libvpx-utils (ALAS2023-2023-413)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-413 advisory. VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. CVE-2023-44488 Tenable has extracted the preceding description block directly from the tested product security...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2023-404)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-404 advisory. A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the...

Amazon Linux 2023 : opensc (ALAS2023-2023-417)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-417 advisory. Potential PIN bypass.When the token/card was plugged into the computer and authenticated from one process, it could be used to provide cryptographic operations from different process when the...

Amazon Linux 2023 : jackson-databind (ALAS2023-2023-428)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-428 advisory. jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service 2 GB transient heap usage per read in uncommon situations involving JsonNode J...

Amazon Linux AMI : mysql57 (ALAS-2023-1878)

The version of mysql57 installed on the remote host is prior to 5.7.43-1.20. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1878 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Client programs. Supported versions that are affected are...

Amazon Linux AMI : php56 (ALAS-2023-1879)

The version of php56 installed on the remote host is prior to 5.6.40-1.144. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1879 advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause...

Amazon Linux AMI : docker (ALAS-2023-1881)

The version of docker installed on the remote host is prior to 20.10.13-3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1881 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block...

Amazon Linux AMI : httpd24 (ALAS-2023-1877)

The version of httpd24 installed on the remote host is prior to 2.4.58-1.101. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1877 advisory. Out-of-bounds Read vulnerability in modmacro of Apache HTTP Server.This issue affects Apache HTTP Server: through...