Amazon Linux AMI : libX11 (ALAS-2023-1895)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1895 advisory. A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to...

Low: libarchive

Issue Overview: In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference or, in some cases, even arbitrary code execution. CVE-2022-36227 Affected...

Medium: jettison

Issue Overview: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of servic...

Low: advancecomp

Issue Overview: advancecomp has a segmentation fault on invalid MNG size CVE-2023-2961 Affected Packages: advancecomp Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Ru...

Amazon Linux 2 : libtiff (ALAS-2023-2347)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2347 advisory. An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen API may allow a remote attacker to cause a...

Amazon Linux 2 : wireshark (ALAS-2023-2348)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2348 advisory. A heap based buffer overflow in Wireshark's NetScreen file parser may lead to a local arbitrary code execution via a crafted...

Amazon Linux 2 : advancecomp (ALAS-2023-2361)

The version of advancecomp installed on the remote host is prior to 1.15-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2361 advisory. advancecomp has a segmentation fault on invalid MNG size CVE-2023-2961 Tenable has extracted the preceding description block...

Amazon Linux 2 : xorg-x11-server (ALAS-2023-2352)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2352 advisory. A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration a multi-screen setup with multiple protocol screens, also known as Zaphod...

Amazon Linux 2 : dovecot (ALAS-2023-2365)

The version of dovecot installed on the remote host is prior to 2.2.36-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2365 advisory. An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist wi...

Important: kernel-livepatch-5.10.192-183.736

Issue Overview: An issue was discovered in drivers/net/ethernet/intel/igb/igbmain.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. CVE-2023-45871 A use-after-free vulnerability in the Linux kernel's netfilter: nftables compone...

Important: kernel-livepatch-5.10.192-182.736

Issue Overview: An issue was discovered in drivers/net/ethernet/intel/igb/igbmain.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. CVE-2023-45871 A use-after-free vulnerability in the Linux kernel's netfilter: nftables compone...

Amazon Linux 2 : kernel (ALAS-2023-2359)

The version of kernel installed on the remote host is prior to 4.14.330-250.540. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2359 advisory. 2024-12-05: CVE-2023-52868 was added to this advisory. 2024-12-05: CVE-2023-52867 was added to this advisory...

Amazon Linux 2 : libarchive (ALAS-2023-2374)

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2374 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists,...

Amazon Linux 2 : python-pip (ALAS-2023-2349)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2349 advisory. When installing a package from a Mercurial VCS URL ie pip installhg+... with pip prior to v23.3, the specified Mercurial revision couldbe used to inject arbitrary configuration options to the hg clonecall...

Amazon Linux 2 : binutils (ALAS-2023-2373)

The version of binutils installed on the remote host is prior to 2.29.1-31. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2373 advisory. An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangletype in...

Amazon Linux 2 : libarchive (ALAS-2023-2364)

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2364 advisory. In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer...

Amazon Linux 2 : avahi (ALAS-2023-2372)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2372 advisory. A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi...

Low: gawk

Issue Overview: A heap out-of-bounds read flaw was found in builtin.c in the gawk package which may result in a crash of the software. CVE-2023-4156 Affected Packages: gawk Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between A...

Medium: python-pip

Issue Overview: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call ie "--config". Controlling the Mercurial configuration can modify how...

Low: uriparser

Issue Overview: An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax. CVE-2021-46142 Affected Packages: uriparser Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2...