Amazon Linux 2 : openssl11 (ALAS-2023-1974)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1974 advisory. AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the...

Amazon Linux 2 : libdb (ALAS-2023-1965)

The version of libdb installed on the remote host is prior to 5.3.21-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1965 advisory. Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges ...

Amazon Linux AMI : freeradius (ALAS-2023-1699)

The version of freeradius installed on the remote host is prior to 2.2.6-7.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1699 advisory. When an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionarie...

Amazon Linux 2 : curl (ALAS-2023-1986)

The version of curl installed on the remote host is prior to 7.88.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1986 advisory. A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the sam...

Amazon Linux 2 : cpio (ALAS-2023-1972)

The version of cpio installed on the remote host is prior to 2.12-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1972 advisory. GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer...

Amazon Linux 2 : protobuf (ALAS-2023-1973)

The version of protobuf installed on the remote host is prior to 2.5.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1973 advisory. A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2,...

Amazon Linux 2 : batik (ALAS-2023-1966)

The version of batik installed on the remote host is prior to 1.8-0.12.svn1230816. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1966 advisory. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the...

Amazon Linux 2 : vim (ALAS-2023-1975)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1975 advisory. A heap buffer overflow vulnerability was found in vim's inscomplinfercasegettext function of the src/insexpand.c file. This flaw occurs when vim tries to access uninitialized memory when completi...

Amazon Linux 2 : cifs-utils, --advisory ALAS2-2023-1977 (ALAS-2023-1977)

The version of cifs-utils installed on the remote host is prior to 6.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1977 advisory. A flaw was found in cifs-utils. When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2023-1697)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.362.b08-1.72. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1697 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : qt5-qtsvg (ALAS-2023-1968)

The version of qt5-qtsvg installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1968 advisory. Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend...

Amazon Linux 2 : sudo (ALAS-2023-1985)

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1985 advisory. In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables...

Amazon Linux AMI : git (ALAS-2023-1700)

The version of git installed on the remote host is prior to 2.38.4-1.80. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1700 advisory. Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36....

Amazon Linux AMI : batik (ALAS-2023-1695)

The version of batik installed on the remote host is prior to 1.7-10.10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1695 advisory. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel...

Important: kernel-livepatch-5.10.155-138.670

Issue Overview: A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution. CVE-2023-0179 Affected...

Amazon Linux 2 : cifs-utils (ALAS-2023-1978)

The version of cifs-utils installed on the remote host is prior to 6.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1978 advisory. A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local...

Amazon Linux 2 : emacs (ALAS-2023-1981)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1981 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, becau...

Amazon Linux 2 : qt5-qtbase (ALAS-2023-1967)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1967 advisory. Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath called from...

Amazon Linux 2 : xorg-x11-server (ALAS-2023-1982)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1982 advisory. 2024-05-23: CVE-2022-46343 was added to this advisory. 2024-05-23: CVE-2022-46341 was added to this advisory. 2024-05-23: CVE-2022-46344 was added to this advisory. 2024-05-23: CVE-2022-46340 was...

Amazon Linux 2 : freeradius (ALAS-2023-1970)

The version of freeradius installed on the remote host is prior to 3.0.26-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1970 advisory. The EAP-PWD function computepasswordelement leaks information about the password which allows an attacker to...