Amazon Linux 2 : kernel, --advisory ALAS2-2023-2027 (ALAS-2023-2027)

The version of kernel installed on the remote host is prior to 4.14.313-235.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2027 advisory. A use-after-free flaw was found in vhostnetsetbackend in drivers/vhost/net.c in virtio network subcomponent in the...

Amazon Linux 2 : pcs (ALAS-2023-2022)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2022 advisory. The Ruby on Rails advisory describes this vulnerability as follows: Carefully crafted input can cause header parsing in Rack to take ...

Important: kernel

Issue Overview: A use-after-free flaw was found in vhostnetsetbackend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem. CVE-2023-1838...

Amazon Linux 2 : openldap (ALAS-2023-2033)

The version of openldap installed on the remote host is prior to 2.4.44-25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2033 advisory. An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relyi...

Amazon Linux 2 : screen (ALAS-2023-2023)

The version of screen installed on the remote host is prior to 4.1.0-0.27.20120314git3c2946. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2023 advisory. socket.c in GNU Screen through 4.9.0, when installed setuid or setgid the default on platforms such as Arch Lin...

Important: nasm

Issue Overview: NASM v2.16 was discovered to contain a heap buffer overflow in the component quoteforpmake asm/nasm.c:856 CVE-2022-44370 Affected Packages: nasm Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and...

Amazon Linux 2 : ghostscript (ALAS-2023-2019)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2019 advisory. In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the...

Amazon Linux 2 : ldns (ALAS-2023-2032)

The version of ldns installed on the remote host is prior to 1.6.16-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2032 advisory. When ldns version 1.7.1 verifies a zone file, the ldnsrrnewfrmstrinternal function has a heap out of bounds read vulnerability. An...

Amazon Linux 2 : golang (ALAS-2023-2024)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2024 advisory. Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2023-2026)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.19+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2026 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2023-2025)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.7+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2025 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Medium: ldns

Issue Overview: When ldns version 1.7.1 verifies a zone file, the ldnsrrnewfrmstrinternal function has a heap out of bounds read vulnerability. An attacker can leak information on the heap by constructing a zone file payload. CVE-2020-19860 Affected Packages: ldns Note: This advisory is applicabl...

Low: screen

Issue Overview: socket.c in GNU Screen through 4.9.0, when installed setuid or setgid the default on platforms such as Arch Linux and FreeBSD, allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process. CVE-2023-24626 Affected...

Amazon Linux 2 : thunderbird (ALAS-2023-2028)

The version of thunderbird installed on the remote host is prior to 102.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2028 advisory. 2024-01-03: CVE-2023-1999 was added to this advisory. The Mozilla Foundation describes this issue as follows:OCSP...

Amazon Linux 2 : xstream (ALAS-2023-2030)

The version of xstream installed on the remote host is prior to 1.3.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2030 advisory. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability...

Important: xstream

Issue Overview: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new...

Amazon Linux 2 : libxml2 (ALAS-2023-2021)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2021 advisory. A NULL pointer dereference exists when parsing invalid XML schemas in libxml2 xmlSchemaCheckCOSSTDerivedOK CVE-2023-28484...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-031 (ALASKERNEL-5.10-2023-031)

The version of kernel installed on the remote host is prior to 5.10.178-162.673. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-031 advisory. In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix data-races in...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-044 (ALASKERNEL-5.4-2023-044)

The version of kernel installed on the remote host is prior to 5.4.241-150.347. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-044 advisory. A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows...

Medium: docker

Issue Overview: A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the supplementary group access setup. CVE-2022-36109 Docker version 20.10.15, build fd82621 is vulnerable to Insecure Permissions. Unauthorized users outside the Docker...