Amazon Linux AMI : glib2 (ALAS-2023-1775)

The version of glib2 installed on the remote host is prior to 2.36.3-5.26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1775 advisory. Heap-based buffer overflow in the findfixedlength function in pcrecompile.c in PCRE before 8.38 allows remote attackers t...

Amazon Linux AMI : kernel (ALAS-2023-1773)

The version of kernel installed on the remote host is prior to 4.14.318-166.529. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1773 advisory. 2024-02-01: CVE-2024-0775 was added to this advisory. A use-after-free flaw was found in nftables cross-table in th...

Amazon Linux AMI : perl-HTTP-Tiny (ALAS-2023-1771)

The version of perl-HTTP-Tiny installed on the remote host is prior to 0.033-3.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1771 advisory. Warning has been added when HTTP::Tiny is used without verifyssl flag CVE-2023-31486 Tenable has extracted the preceding...

Amazon Linux AMI : mod24_security (ALAS-2023-1772)

The version of mod24security installed on the remote host is prior to 2.8.0-5.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1772 advisory. In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web...

Amazon Linux AMI : squid (ALAS-2023-1774)

The version of squid installed on the remote host is prior to 3.5.20-17.49. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1774 advisory. An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When...

Amazon Linux 2 : qpdf (ALAS-2023-2104)

The version of qpdf installed on the remote host is prior to 5.0.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2104 advisory. QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in PlASCII85Decoder::write called from PlAESPDF::flush...

Amazon Linux 2 : openldap (ALAS-2023-2095)

The version of openldap installed on the remote host is prior to 2.4.44-25. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2095 advisory. A vulnerability was found in openldap that can cause a null pointer dereference in the bermemallocx function. CVE-2023-2953...

Amazon Linux 2 : glib2 (ALAS-2023-2107)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2107 advisory. PCRE before 8.38 mishandles the : and \ substrings in character classes, which allows remote attackers to cause a denial of...

Amazon Linux 2 : openssl11 (ALAS-2023-2097)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2097 advisory. Issue summary: Processing some specially crafted ASN.1 object identifiers ordata containing them may be very slow. Impact...

Amazon Linux 2 : qt5-qtsvg (ALAS-2023-2092)

The version of qt5-qtsvg installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2092 advisory. In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont munitsPerEm...

Amazon Linux 2 : perl-HTTP-Tiny (ALAS-2023-2093)

The version of perl-HTTP-Tiny installed on the remote host is prior to 0.033-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2093 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuratio...

Amazon Linux 2 : qt5-qtbase (ALAS-2023-2091)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2091 advisory. An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for...

Amazon Linux 2 : qt (ALAS-2023-2090)

The version of qt installed on the remote host is prior to 4.8.5-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2090 advisory. An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS do...

Amazon Linux 2 : perl-Pod-Perldoc (ALAS-2023-2094)

The version of perl-Pod-Perldoc installed on the remote host is prior to 3.20-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2094 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configurati...

Amazon Linux 2 : python-pillow (ALAS-2023-2105)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2105 advisory. An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number o...

Amazon Linux 2 : flac (ALAS-2023-2106)

The version of flac installed on the remote host is prior to 1.3.0-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2106 advisory. An out-of-bounds write vulnerability was found in libFlak. The vulnerability occurs due to a missing bounds check. This flaw allows a...

Amazon Linux 2 : kernel (ALAS-2023-2108)

The version of kernel installed on the remote host is prior to 4.14.318-241.531. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2108 advisory. An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with certain...

Amazon Linux 2 : opensc (ALAS-2023-2102)

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2102 advisory. A heap use after free issue was found in Opensc before version 0.22.0 in scfilevalid. CVE-2021-42779 A use after return...

Amazon Linux 2 : mod_security (ALAS-2023-2098)

The version of modsecurity installed on the remote host is prior to 2.9.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2098 advisory. In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the...

Amazon Linux 2 : qpdf (ALAS-2023-2099)

The version of qpdf installed on the remote host is prior to 5.0.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2099 advisory. QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows...