Amazon Linux 2 : php (ALASPHP8.0-2023-008)

The version of php installed on the remote host is prior to 8.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-008 advisory. Several flaws has been found in php. The pdofirebase module does not check the length of the server version string in a...

Amazon Linux 2 : php (ALASPHP8.0-2023-005)

The version of php installed on the remote host is prior to 8.0.24-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-005 advisory. In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip...

Amazon Linux 2 : php (ALASPHP8.0-2023-007)

The version of php installed on the remote host is prior to 8.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.0-2023-007 advisory. A flaw was found in PHP. The vulnerability occurs due to the malformed phpfilterfloat function and leads to a use-after-free...

Amazon Linux 2 : php (ALASPHP8.0-2023-004)

The version of php installed on the remote host is prior to 8.0.25-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-004 advisory. In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont function in gd extension, it is possible to...

Amazon Linux 2 : openssl (ALAS-2023-2246)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2246 advisory. Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use t...

Amazon Linux AMI : poppler (ALAS-2023-1821)

The version of poppler installed on the remote host is prior to 0.26.5-43.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1821 advisory. In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service application crashes with...

Amazon Linux AMI : python38 (ALAS-2023-1816)

The version of python38 installed on the remote host is prior to 3.8.5-1.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1816 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It...

Amazon Linux AMI : ruby20 (ALAS-2023-1824)

The version of ruby20 installed on the remote host is prior to 2.0.0.648-2.42. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1824 advisory. An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. ...

Amazon Linux AMI : ca-certificates (ALAS-2023-1817)

The version of ca-certificates installed on the remote host is prior to 2018.2.22-65.1.31. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1817 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while...

Amazon Linux AMI : clamav (ALAS-2023-1820)

The version of clamav installed on the remote host is prior to 0.103.9-1.55. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1820 advisory. A vulnerability in the filesystem image parser for Hierarchical File System Plus HFS+ of ClamAV could allow an unauthenticated,...

Amazon Linux AMI : amazon-ssm-agent (ALAS-2023-1825)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1377.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1825 advisory. The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker t...

Amazon Linux AMI : kernel (ALAS-2023-1819)

The version of kernel installed on the remote host is prior to 4.14.322-170.538. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1819 advisory. A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality...

Amazon Linux AMI : krb5 (ALAS-2023-1818)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1818 advisory. lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because...

Amazon Linux AMI : poppler (ALAS-2023-1823)

The version of poppler installed on the remote host is prior to 0.26.5-43.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1823 advisory. Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service...

Amazon Linux 2023 : dmidecode (ALAS2023-2023-328)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-328 advisory. Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. CVE-2023-30630 Tenable has extracted the...

Amazon Linux 2 : curl (ALAS-2023-2230)

The version of curl installed on the remote host is prior to 8.2.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2230 advisory. Integer overflow vulnerability in tooloperate.c in curl 7.65.2 via crafted value as the retry delay. CVE-2020-19909 libcurl...

Amazon Linux 2 : poppler (ALAS-2023-2243)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2243 advisory. Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service...

Amazon Linux 2 : cups (ALAS-2023-2228)

The version of cups installed on the remote host is prior to 1.6.3-51. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2228 advisory. An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey...

Amazon Linux 2 : krb5 (ALAS-2023-2225)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2225 advisory. lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2023-317)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-317 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client...