Amazon Linux 2 : libssh2 (ALAS-2023-2046)

The version of libssh2 installed on the remote host is prior to 1.4.3-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2046 advisory. An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the libssh2packetrequire and libssh2packetrequirev...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2023-2038)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.372.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2038 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : perl (ALAS-2023-2034)

The version of perl installed on the remote host is prior to 5.16.3-299. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2034 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where...

Amazon Linux 2 : glib2 (ALAS-2023-2049)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2049 advisory. In GNOME GLib 2.56.1, gmarkupparsecontextendparse in gmarkup.c has a NULL pointer dereference. CVE-2018-16428 GNOME GLib...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-018)

The version of kernel installed on the remote host is prior to 5.15.110-70.141. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-018 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : tomcat (ALAS-2023-2047)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2047 advisory. A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A local attacker...

Amazon Linux 2 : inkscape (ALAS-2023-2043)

The version of inkscape installed on the remote host is prior to 0.92.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2043 advisory. Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-045)

The version of kernel installed on the remote host is prior to 5.4.242-155.348. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-045 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : openssl11 (ALAS-2023-2039)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2039 advisory. A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509...

Amazon Linux 2 : golang (ALAS-2023-2037)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2037 advisory. HTTP and MIME header parsing could allocate large amounts of memory, even when parsing small inputs. Certain unusual patterns of...

Amazon Linux 2 : libwebp (ALAS-2023-2048)

The version of libwebp installed on the remote host is prior to 0.3.0-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2048 advisory. 2023-08-03: CVE-2018-25014 was added to this advisory. A heap-based buffer overflow was found in libwebp in versions befo...

Amazon Linux 2 : wireshark (ALAS-2023-2040)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2040 advisory. TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection ...

Amazon Linux 2 : gd (ALAS-2023-2044)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2044 advisory. DISPUTED gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is...

Amazon Linux 2 : jdom (ALAS-2023-2045)

The version of jdom installed on the remote host is prior to 1.1.3-6.1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2045 advisory. An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-032)

The version of kernel installed on the remote host is prior to 5.10.179-166.674. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-032 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : libksba (ALAS-2023-2041)

The version of libksba installed on the remote host is prior to 1.3.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2041 advisory. Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE-2022-47629 Tenable has extracte...

Amazon Linux 2 : samba (ALAS-2023-2042)

The version of samba installed on the remote host is prior to 4.10.16-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2042 advisory. Netlogon RPC Elevation of Privilege Vulnerability. CVE-2022-38023 Tenable has extracted the preceding description block directly...

Amazon Linux 2 : qt5-qtbase (ALAS-2023-2036)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2036 advisory. When using the Qt SQL ODBC driver plugin, then it is possible to trigger a DOS with a specifically crafted string RESERVEDNOTE:...

Medium: openssl11

Issue Overview: A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers...

Important: libksba

Issue Overview: Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE-2022-47629 Affected Packages: libksba Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...