Amazon Linux 2 : python-pillow (ALAS-2023-2118)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2118 advisory. The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service ReDoS via the...

Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-259)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-259 advisory. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. CVE-2023-20867 Tenable ha...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2023-2137)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.20+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2137 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product...

Amazon Linux 2 : mc (ALAS-2023-2147)

The version of mc installed on the remote host is prior to 4.8.29-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2147 advisory. An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is...

Amazon Linux 2 : libzapojit (ALAS-2023-2144)

The version of libzapojit installed on the remote host is prior to 0.0.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2144 advisory. In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-237)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-237 advisory. The use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-253)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-253 advisory. libtiff 4.5.0 is vulnerable to Buffer Overflow in uvencode when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. CVE-2023-26966 Tenable has extracted the...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-024 (ALASKERNEL-5.15-2023-024)

The version of kernel installed on the remote host is prior to 5.15.120-74.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-024 advisory. A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and...

Amazon Linux 2 : protobuf-c (ALAS-2023-2142)

The version of protobuf-c installed on the remote host is prior to 1.0.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2142 advisory. protobuf-c before 1.4.1 has an unsigned integer overflow in parserequiredmember. CVE-2022-48468 Tenable has extracted the...

Amazon Linux 2 : qemu, --advisory ALAS2-2023-2148 (ALAS-2023-2148)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2148 advisory. A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-240)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-240 advisory. A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order,...

Amazon Linux 2 : lynx (ALAS-2023-2145)

The version of lynx installed on the remote host is prior to 2.8.9-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2145 advisory. Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials...

Amazon Linux AMI : tomcat8 (ALAS-2023-1779)

The version of tomcat8 installed on the remote host is prior to 8.5.89-1.93. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1779 advisory. The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.8...

Amazon Linux 2 : fribidi (ALAS-2023-2116)

The version of fribidi installed on the remote host is prior to 1.0.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2116 advisory. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially...

Amazon Linux 2023 : libX11, libX11-common, libX11-devel (ALAS2023-2023-250)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-250 advisory. A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the...

Amazon Linux AMI : c-ares (ALAS-2023-1780)

The version of c-ares installed on the remote host is prior to 1.17.2-1.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1780 advisory. A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allow...

Amazon Linux 2 : grub2 (ALAS-2023-2146)

The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2146 advisory. A flaw was found in grub 2, where a crafted 16-bit grayscale PNG image may lead to an out-of-bounds write. This flaw allows ...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2023-258)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-258 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle...

Amazon Linux 2 : gstreamer-plugins-base (ALAS-2023-2121)

The version of gstreamer-plugins-base installed on the remote host is prior to 0.10.36-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2121 advisory. Integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the...

Amazon Linux 2 : ImageMagick (ALAS-2023-2123)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2123 advisory. The upstream bug report describes this issue as follows:A vulnerability was found in ImageMagick =7.1.1, where heap-based...