Amazon Linux 2 : libX11 (ALAS-2023-2129)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2129 advisory. A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the...

Amazon Linux 2 : libtiff (ALAS-2023-2126)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2126 advisory. A NULL pointer dereference in TIFFClose is caused by a failure to open an output file non-existent path or a path that requires...

Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2023-262)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-262 advisory. A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read50controllercapcomplete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of...

Amazon Linux 2 : python-pip (ALAS-2023-2151)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2151 advisory. A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and IPv6Interface classes. This flaw allows an attacker to create many dictionary entries, due to...

Amazon Linux 2 : zstd (ALAS-2023-2140)

The version of zstd installed on the remote host is prior to 1.5.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2140 advisory. In zstd, supplying an empty string as an argument to either --output-dir-flat or --output-dir-mirror may cause a buffer overrun...

Amazon Linux 2023 : python3-wheel, python3-wheel-wheel (ALAS2023-2023-261)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-261 advisory. An issue discovered in Python Packaging Authority PyPA Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE-2022-40898 Tenable ha...

Amazon Linux 2023 : jackson-core (ALAS2023-2023-248)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-248 advisory. An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-35116 Tenable h...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2139)

The version of open-vm-tools installed on the remote host is prior to 12.2.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2139 advisory. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the...

Amazon Linux 2 : libcap (ALAS-2023-2136)

The version of libcap installed on the remote host is prior to 2.54-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2136 advisory. libcap is vulnerable to a denial of service caused by the error handling in wrappthreadcreate function, which will cause memory to be...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-037 (ALASKERNEL-5.10-2023-037)

The version of kernel installed on the remote host is prior to 5.10.184-175.749. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-037 advisory. A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and...

Amazon Linux AMI : python-imaging (ALAS-2023-1787)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1787 advisory. Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the crafted image file approach, related to an Insecure Sign Extension issue affecting the ImagingNew in Storage.c...

Amazon Linux AMI : golang (ALAS-2023-1784)

The version of golang installed on the remote host is prior to 1.18.6-1.45. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1784 advisory. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a g...

Amazon Linux 2 : pidgin (ALAS-2023-2115)

The version of pidgin installed on the remote host is prior to 2.10.11-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2115 advisory. An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2023-2138)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.8+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2138 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product ...

Amazon Linux AMI : wireshark (ALAS-2023-1785)

The version of wireshark installed on the remote host is prior to 1.8.10-25.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1785 advisory. Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in a...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2023-256)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-256 advisory. 2023-07-20: The severity level was changed from low to medium. Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u371. Difficult to...

Amazon Linux 2023 : libzstd, libzstd-devel, libzstd-static (ALAS2023-2023-244)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-244 advisory. In zstd, supplying an empty string as an argument to either --output-dir-flat or --output-dir-mirror may cause a buffer overrun. CVE-2022-4899 Tenable has extracted the preceding description block...

Amazon Linux AMI : libX11 (ALAS-2023-1782)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1782 advisory. A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-255)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-255 advisory. LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from source...

Amazon Linux 2023 : python3-requests, python3-requests+security, python3-requests+socks (ALAS2023-2023-236)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-236 advisory. A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy- Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This...