Amazon Linux 2 : aide (ALAS-2022-1850)

The version of aide installed on the remote host is prior to 0.16.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1850 advisory. A heap-based buffer overflow vulnerability in the base64 functions of AIDE, an advanced intrusion detection system. An attacker could...

Amazon Linux 2 : thunderbird (ALAS-2022-1855)

The version of thunderbird installed on the remote host is prior to 91.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1855 advisory. A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers and...

Amazon Linux 2 : xorg-x11-server (ALAS-2022-1856)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1856 advisory. A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length. CVE-2022-2319 A flaw was foun...

Amazon Linux 2 : golang (ALAS-2022-1851)

The version of golang installed on the remote host is prior to 1.18.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1851 advisory. In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can...

Amazon Linux 2 : golist (ALAS-2022-1847)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1847 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A...

Amazon Linux 2 : systemd (ALAS-2022-1854)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1854 advisory. It was discovered that pamsystemd does not properly sanitize the environment before using the XDGSEAT variable. It is...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1852 (ALAS-2022-1852)

The version of kernel installed on the remote host is prior to 4.14.294-220.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1852 advisory. An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver functionality in the...

Amazon Linux 2 : golang, --advisory ALAS2-2022-1846 (ALAS-2022-1846)

The version of golang installed on the remote host is prior to 1.18.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1846 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A...

Amazon Linux 2 : krb5 (ALAS-2022-1845)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1845 advisory. A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1encode.c support for BER indefinite lengths lacks a recursion limit...

Amazon Linux 2 : ruby (ALAS-2022-1853)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1853 advisory. A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes...

Amazon Linux 2 : libxml2 (ALAS-2022-1848)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1848 advisory. A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the xmlBuffer types. A substantial input...

Amazon Linux 2 : zlib (ALAS-2022-1849)

The version of zlib installed on the remote host is prior to 1.2.7-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1849 advisory. A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large...

Important: aide

Issue Overview: A heap-based buffer overflow vulnerability in the base64 functions of AIDE, an advanced intrusion detection system. An attacker could crash the program and possibly execute arbitrary code through large 16k extended file attributes or ACL. CVE-2021-45417 Affected Packages: aide Not...

Medium: libxml2

Issue Overview: A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the xmlBuffer types. A substantial input causes values to calculate buffer sizes to overflow, resulting in an out-of-bounds write. CVE-2022-29824 Affected Packages: libxml2 Note: This advisory i...

Medium: zlib

Issue Overview: A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large gzip header extra field. This flaw is only applicable in the call inflateGetHeader. CVE-2022-37434 Affected Packages: zlib Note: This advisory is...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1838 (ALAS-2022-1838)

The version of kernel installed on the remote host is prior to 4.14.291-218.527. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1838 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-007)

The version of kernel installed on the remote host is prior to 5.15.59-33.133. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-007 advisory. An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2022-1836)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.342.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1836 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-035)

The version of kernel installed on the remote host is prior to 5.4.209-116.367. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-035 advisory. An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a...

Amazon Linux 2 : python-bottle (ALAS-2022-1844)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1844 advisory. Bottle before 0.12.20 mishandles errors during early request binding. CVE-2022-31799 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that...