Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-350)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-350 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the- middle MITM network positioning between vCenter server and the virtual machine may be able to bypass...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-344)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-344 advisory. Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2023-347)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-347 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to...

Amazon Linux 2023 : nasm, nasm-rdoff (ALAS2023-2023-354)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-354 advisory. A Segmentation Fault issue discovered in in ieeesegment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a denial of service via crafted assembly file. CVE-2020-21528...

Amazon Linux 2023 : docker (ALAS2023-2023-345)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-345 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-348)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-348 advisory. Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of servi...

Amazon Linux 2023 : cpp, gcc, gcc-c++ (ALAS2023-2023-342)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-342 advisory. An issue was found in a defense in depth feature of the GCC compiler on aarch64 platforms. The stack protector feature -fstack-protector did not detect or defend against overflows of dynamically-sized...

Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-320)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-320 advisory. ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw. CVE-2023-39978 Tenable has extracted the preceding description block directly from the test...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2023-317)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-317 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2023-337)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-337 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2023-323)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-323 advisory. Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archiv...

Amazon Linux 2023 : file, file-devel, file-libs (ALAS2023-2023-333)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-333 advisory. File before 5.43 has an stack-based buffer over-read in filecopystr in funcs.c. NOTE: File is the name of an Open Source project. CVE-2022-48554 Tenable has extracted the preceding description block...

Amazon Linux 2023 : indent (ALAS2023-2023-318)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-318 advisory. GNU indent 2.2.13 has a heap-based buffer overflow in searchbrace in indent.c via a crafted file. CVE-2023-40305 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : hwloc, hwloc-devel, hwloc-gui (ALAS2023-2023-335)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-335 advisory. An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. CVE-2022-47022 Tenable has extracted the...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-327)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-327 advisory. An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to acces...

Amazon Linux 2023 : gdk-pixbuf2, gdk-pixbuf2-devel, gdk-pixbuf2-modules (ALAS2023-2023-341)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-341 advisory. GNOME GdkPixbuf aka GDK-PixBuf before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c compositeframe. This overflow is...

Amazon Linux 2023 : avahi, avahi-autoipd, avahi-compat-howl (ALAS2023-2023-332)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-332 advisory. avahi-daemon denial of service can be caused by unprivileged users via DBus CVE-2023-1981 Tenable has extracted the preceding description block directly from the tested product security advisory. Note...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2023-339)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-339 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2023-324)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-324 advisory. In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities...

Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2023-340)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-340 advisory. An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an...